mirrors/node
0
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-10-28 10:15:07 +08:00
Code Activity

test,benchmark: drop OpenSSL 1.x-only coverage

Browse Source 
Delete test-crypto-ecb.js, which can no longer run anywhere: Blowfish
is available only from OpenSSL's legacy provider and is absent from
BoringSSL.

The addon and cctest version guards become OPENSSL_IS_BORINGSSL checks.
Remove legacy digest-alias coverage and unreachable OpenSSL 1.x
branches. JavaScript test and benchmark gates, skip reasons, and TLS
error expectations that distinguished OpenSSL 1.x from provider-backed
OpenSSL now distinguish BoringSSL, including PKCS12 parsing, named DH
groups, private-key serialization, RSA-PSS parameters, consolidated
provider caches, FIPS availability, and empty KMAC output. Keep the CCM
alternate finalization error only for BoringSSL.

Provider-only test skips use version-neutral terminology or state the
actual minimum OpenSSL version.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
This commit is contained in:
Filip Skokan committed 2026-10-25 22:36:32 +01:00
1 parent 8be36fb494
commit acbc3ff133
104 files changed
+338 -614
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

benchmark/crypto/kem.js
+2 -2
View File
@@ -35,12 +35,12 @@ if (hasOpenSSL(3, 2)) {
keyFixtures.x25519 = readKeyPair('x25519_public', 'x25519_private');
keyFixtures.x448 = readKeyPair('x448_public', 'x448_private');
}
if (hasOpenSSL(3, 0)) {
if (!isBoringSSL) {
keyFixtures.rsa = readKeyPair('rsa_public_2048', 'rsa_private_2048');
}
if (Object.keys(keyFixtures).length === 0) {
console.log('no supported key types available for this OpenSSL version');
console.log('no supported key types available for this crypto implementation');
process.exit(0);
}
benchmark/crypto/mac.js
+3 -4
View File
@@ -1,7 +1,7 @@
'use strict';
const common = require('../common.js');
const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
const { isBoringSSL } = require('../../test/common/crypto.js');
const assert = require('node:assert');
const {
createHmac,
@@ -9,11 +9,10 @@ const {
getMacs,
} = require('node:crypto');
if (!hasOpenSSL(3) ||
isBoringSSL ||
if (isBoringSSL ||
typeof createMac !== 'function' ||
typeof getMacs !== 'function') {
console.log('Skipping: generic MAC API requires OpenSSL >= 3');
console.log('Skipping: generic MAC API requires OpenSSL EVP_MAC support');
process.exit(0);
}
test/addons/openssl-providers/binding.cc
+5 -4
View File
@@ -1,8 +1,9 @@
#include <assert.h>
#include <node.h>
#include <openssl/opensslv.h>
#if OPENSSL_VERSION_MAJOR >= 3
// BoringSSL declares OPENSSL_IS_BORINGSSL in crypto.h.
#include <openssl/crypto.h>
#ifndef OPENSSL_IS_BORINGSSL
#include <openssl/provider.h>
#endif
@@ -18,7 +19,7 @@ using v8::Object;
using v8::String;
using v8::Value;
#if OPENSSL_VERSION_MAJOR >= 3
#ifndef OPENSSL_IS_BORINGSSL
int collectProviders(OSSL_PROVIDER* provider, void* cbdata) {
static_cast<std::vector<OSSL_PROVIDER*>*>(cbdata)->push_back(provider);
return 1;
@@ -28,7 +29,7 @@ int collectProviders(OSSL_PROVIDER* provider, void* cbdata) {
inline void GetProviders(const FunctionCallbackInfo<Value>& args) {
Isolate* isolate = args.GetIsolate();
LocalVector<Value> arr(isolate, 0);
#if OPENSSL_VERSION_MAJOR >= 3
#ifndef OPENSSL_IS_BORINGSSL
std::vector<OSSL_PROVIDER*> providers;
OSSL_PROVIDER_do_all(nullptr, &collectProviders, &providers);
for (auto provider : providers) {
test/addons/openssl-providers/providers.cjs
+3 -3
View File
@@ -4,10 +4,10 @@ const common = require('../../common');
if (!common.hasCrypto) {
common.skip('missing crypto');
}
const { hasOpenSSL } = require('../../common/crypto');
const { isBoringSSL } = require('../../common/crypto');
if (!hasOpenSSL(3)) {
common.skip('this test requires OpenSSL 3.x');
if (isBoringSSL) {
common.skip('OpenSSL provider support is required');
}
const assert = require('node:assert');
const {
test/cctest/test_node_crypto_env.cc
+1 -1
View File
@@ -26,7 +26,7 @@ TEST_F(NodeCryptoEnv, LoadBIO) {
// just put a random string into BIO
Local<String> key = String::NewFromUtf8(isolate_, "abcdef").ToLocalChecked();
ncrypto::BIOPointer bio(node::crypto::LoadBIO(*env, key));
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
#ifndef OPENSSL_IS_BORINGSSL
const int ofs = 2;
ASSERT_EQ(BIO_seek(bio.get(), ofs), ofs);
ASSERT_EQ(BIO_tell(bio.get()), ofs);
test/common/crypto.js
-3
View File
@@ -147,9 +147,6 @@ module.exports = {
hasOpenSSL,
hasFIPS,
isBoringSSL,
get hasOpenSSL3() {
return hasOpenSSL(3);
},
// opensslCli defined lazily to reduce overhead of spawnSync
get opensslCli() {
if (opensslCli !== null) return opensslCli;
test/fixtures/webcrypto/supports-modern-algorithms.mjs
Vendored
+2 -2
View File
@@ -13,8 +13,8 @@ const shake128 = crypto.getHashes().includes('shake128');
const shake256 = crypto.getHashes().includes('shake256');
const cshake128 = crypto.getHashes().includes('cshake128');
const cshake256 = crypto.getHashes().includes('cshake256');
const ocb = hasOpenSSL(3) && crypto.getCiphers().includes('aes-128-ocb');
const kmac = hasOpenSSL(3) && crypto.getMacs().includes('kmac128');
const ocb = !isBoringSSL && crypto.getCiphers().includes('aes-128-ocb');
const kmac = !isBoringSSL && crypto.getMacs().includes('kmac128');
const hybridKems = !fips && pqc && (!boringSSL || shake256);
test/parallel/test-cli-node-options.js
+2 -2
View File
@@ -12,7 +12,7 @@ const { Worker } = require('worker_threads');
const fixtures = require('../common/fixtures');
const tmpdir = require('../common/tmpdir');
const { hasOpenSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
tmpdir.refresh();
const printA = path.relative(tmpdir.path, fixtures.path('printA.js'));
@@ -65,7 +65,7 @@ if (common.isLinux) {
if (common.hasCrypto) {
expectNoWorker('--use-openssl-ca', 'B\n');
expectNoWorker('--use-bundled-ca', 'B\n');
if (!hasOpenSSL(3))
if (isBoringSSL)
expectNoWorker('--openssl-config=_ossl_cfg', 'B\n');
if (common.isMacOS) {
expect('--use-system-ca', 'B\n');
test/parallel/test-config-json-schema.js
+3 -3
View File
@@ -10,10 +10,10 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
const { hasOpenSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3)) {
common.skip('this test requires OpenSSL 3.x');
if (isBoringSSL) {
common.skip('this test is not supported with BoringSSL');
}
if (!common.hasIntl) {
test/parallel/test-crypto-async-sign-verify.js
+6 -8
View File
@@ -3,7 +3,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const util = require('util');
const crypto = require('crypto');
@@ -132,7 +132,7 @@ if (!isBoringSSL) {
common.printSkipMessage('Skipping unsupported ed448/secp256k1/dsa test cases');
}
// Test Parallel Execution w/ KeyObject is threadsafe in openssl3
// Test Parallel Execution w/ KeyObject is threadsafe in OpenSSL
{
const publicKey = {
key: crypto.createPublicKey(
@@ -171,12 +171,10 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
const data = crypto.randomBytes(32);
const signature = crypto.randomBytes(16);
let expected = /no default digest/;
let expectedCode = 'ERR_OSSL_EVP_NO_DEFAULT_DIGEST';
if (hasOpenSSL(3) || isBoringSSL) {
expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
expectedCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
}
const expected =
/operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
const expectedCode =
'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
crypto.verify(undefined, data, untrustedKey, signature, common.mustCall((err) => {
assert.ok(err);
test/parallel/test-crypto-authenticated.js
+1 -1
View File
@@ -819,7 +819,7 @@ for (const test of TEST_CASES) {
} catch (err) {
// OpenSSL without https://github.com/openssl/openssl/pull/32427
// cannot finalize an empty CCM message unless update() was called.
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET');
} else {
assert.match(err.message, /Unsupported state/);
test/parallel/test-crypto-cipheriv-decipheriv.js
+3 -3
View File
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const crypto = require('crypto');
const { hasOpenSSL, hasFIPS } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
const isFipsEnabled = crypto.getFips() === 1;
const fips3 = hasFIPS(3);
@@ -293,8 +293,8 @@ assert.throws(
errMessage);
// But all other IV lengths should be accepted.
const minIvLength = hasOpenSSL(3) ? 8 : 1;
const maxIvLength = hasOpenSSL(3) ? 64 : 256;
const minIvLength = isBoringSSL ? 1 : 8;
const maxIvLength = isBoringSSL ? 256 : 64;
for (let n = minIvLength; n < maxIvLength; n += 1) {
if (isFipsEnabled && n < 12) continue;
crypto.createCipheriv('aes-128-gcm', Buffer.alloc(16), Buffer.alloc(n));
test/parallel/test-crypto-classes.js
+2 -2
View File
@@ -6,7 +6,7 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
const crypto = require('crypto');
const { hasOpenSSL, hasFIPS } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
// 'ClassName' : ['args', 'for', 'constructor']
const TEST_CASES = {
@@ -31,7 +31,7 @@ if (hasFIPS(3)) {
TEST_CASES.DiffieHellman = [2048];
TEST_CASES.DiffieHellmanGroup = ['modp14'];
} else if (crypto.getFips() !== 1) {
TEST_CASES.DiffieHellman = [hasOpenSSL(3) ? 1024 : 256];
TEST_CASES.DiffieHellman = [isBoringSSL ? 256 : 1024];
}
for (const [clazz, args] of Object.entries(TEST_CASES)) {
test/parallel/test-crypto-dh-curves.js
+3 -8
View File
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const crypto = require('crypto');
const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
const {
DH_CHECK_P_NOT_PRIME,
DH_CHECK_P_NOT_SAFE_PRIME,
@@ -70,7 +70,7 @@ const bad_dh = isBoringSSL ?
crypto.createDiffieHellman('02', 'hex');
assert.notStrictEqual(bad_dh.verifyError, 0);
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
const smallSafePrime = crypto.createDiffieHellman(
Buffer.from([23]), Buffer.from([2]));
assert.notStrictEqual(smallSafePrime.verifyError, 0);
@@ -79,11 +79,6 @@ if (hasOpenSSL(3)) {
() => crypto.createDiffieHellman(Buffer.from(p, 'hex'),
Buffer.from(p, 'hex')),
{ code: 'ERR_OSSL_DH_BAD_GENERATOR' });
} else if (!isBoringSSL) {
assert.strictEqual(
crypto.createDiffieHellman(Buffer.from(p, 'hex'),
Buffer.from(p, 'hex')).verifyError,
DH_NOT_SUITABLE_GENERATOR);
}
const availableCurves = new Set(crypto.getCurves());
@@ -279,7 +274,7 @@ if (availableCurves.has('prime256v1') && availableHashes.has('sha256')) {
crypto.createSign('SHA256').sign(ecPrivateKey);
}
if (hasFIPS(3) && availableCurves.has('secp256k1')) {
if (hasFIPS() && availableCurves.has('secp256k1')) {
const originalFips = crypto.getFips();
try {
test/parallel/test-crypto-dh-errors.js
+2 -2
View File
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const crypto = require('crypto');
const { hasOpenSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
// https://github.com/nodejs/node/issues/32738
// XXX(bnoordhuis) validateInt32() throwing ERR_OUT_OF_RANGE and RangeError
@@ -25,7 +25,7 @@ assert.throws(() => crypto.createDiffieHellman('abcdef', 13.37), {
});
for (const bits of [-1, 0, 1]) {
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
assert.throws(() => crypto.createDiffieHellman(bits), {
code: 'ERR_OSSL_DH_MODULUS_TOO_SMALL',
name: 'Error',
test/parallel/test-crypto-dh-odd-key.js
+2 -2
View File
@@ -27,12 +27,12 @@ if (!common.hasCrypto) {
const assert = require('assert');
const crypto = require('crypto');
const { hasOpenSSL, hasFIPS } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
function test() {
const odd = Buffer.alloc(39, 'A');
const size = hasFIPS(3) ? 2048 : (hasOpenSSL(3) ? 1024 : 32);
const size = hasFIPS(3) ? 2048 : (isBoringSSL ? 32 : 1024);
const c = crypto.createDiffieHellman(size);
c.setPrivateKey(odd);
c.generateKeys();
test/parallel/test-crypto-dh-stateless.js
+9 -22
View File
@@ -20,7 +20,7 @@ let keyTypeMismatchCode;
if (hasOpenSSL(4, 0)) {
keyTypeMismatchCode =
/^ERR_OSSL_EVP_(OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE|INTERNAL_ERROR)$/;
} else if (hasOpenSSL(3)) {
} else if (!isBoringSSL) {
keyTypeMismatchCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
} else {
keyTypeMismatchCode = 'ERR_OSSL_EVP_DIFFERENT_KEY_TYPES';
@@ -341,15 +341,6 @@ if (isBoringSSL) {
// Same generator, but different primes.
[{ group: 'modp5' }, { group: 'modp18' }]];
// TODO(danbev): Take a closer look if there should be a check in OpenSSL3
// when the dh parameters differ.
if (!hasOpenSSL(3)) {
// Same primes, but different generator.
list.push([{ group: 'modp5' }, { prime: group.getPrime(), generator: 5 }]);
// Same generator, but different primes.
list.push([{ primeLength: 1024 }, { primeLength: 1024 }]);
}
for (const [params1, params2] of list) {
const options = {
privateKey: crypto.generateKeyPairSync('dh', params1).privateKey,
@@ -357,9 +348,7 @@ if (isBoringSSL) {
};
testDHError(options, {
name: 'Error',
code: hasOpenSSL(3) ?
'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' :
'ERR_OSSL_EVP_DIFFERENT_PARAMETERS'
code: 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS'
});
}
}
@@ -420,9 +409,9 @@ test(crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' }),
};
testDHError(options, {
name: 'Error',
code: hasOpenSSL(3) ?
'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' :
'ERR_OSSL_EVP_DIFFERENT_PARAMETERS'
code: isBoringSSL ?
'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' :
'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS'
});
}
@@ -576,9 +565,9 @@ for (const { privateKey: alicePriv, publicKey: bobPub } of [
testDHError({
privateKey: privKey(ec256.privateKey),
publicKey: pubKey(ec384.publicKey),
}, { code: hasOpenSSL(3) ?
'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' :
'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' });
}, { code: isBoringSSL ?
'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' :
'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' });
// Incompatible key types (ec + x25519)
testDHError({
@@ -607,8 +596,6 @@ for (const { privateKey: alicePriv, publicKey: bobPub } of [
privateKey: privKey(x25519.privateKey),
publicKey: pubKey(zeroX25519PublicKey),
}, isBoringSSL ? { code: 'ERR_OSSL_EVP_INVALID_PEER_KEY' } :
hasOpenSSL(3) ?
{ code: 'ERR_OSSL_FAILED_DURING_DERIVATION' } :
{ message: /Deriving bits failed/ });
{ code: 'ERR_OSSL_FAILED_DURING_DERIVATION' });
}
}
test/parallel/test-crypto-dh.js
+2 -3
View File
@@ -7,14 +7,13 @@ if (!common.hasCrypto) {
const assert = require('assert');
const crypto = require('crypto');
const {
hasOpenSSL,
hasFIPS,
isBoringSSL,
} = require('../common/crypto');
{
const size = hasFIPS(3) ?
2048 : (crypto.getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
2048 : (crypto.getFips() === 1 || !isBoringSSL ? 1024 : 256);
const dh1 = crypto.createDiffieHellman(size);
const p1 = dh1.getPrime('buffer');
const dh2 = crypto.createDiffieHellman(p1, 'buffer');
@@ -60,7 +59,7 @@ const {
assert.strictEqual(secret1, secret4);
let wrongBlockLength;
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
wrongBlockLength = {
message: /wrong[\s_]final[\s_]block[\s_]length/i,
code: /ERR_OSSL_(EVP_)?WRONG_FINAL_BLOCK_LENGTH/,
test/parallel/test-crypto-ecb.js
-63
View File
@@ -1,63 +0,0 @@
// Copyright Joyent, Inc. and other Node contributors.
//
// Permission is hereby granted, free of charge, to any person obtaining a
// copy of this software and associated documentation files (the
// "Software"), to deal in the Software without restriction, including
// without limitation the rights to use, copy, modify, merge, publish,
// distribute, sublicense, and/or sell copies of the Software, and to permit
// persons to whom the Software is furnished to do so, subject to the
// following conditions:
//
// The above copyright notice and this permission notice shall be included
// in all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
// USE OR OTHER DEALINGS IN THE SOFTWARE.
'use strict';
const common = require('../common');
if (!common.hasCrypto) {
common.skip('missing crypto');
}
const { hasOpenSSL } = require('../common/crypto');
const crypto = require('crypto');
if (crypto.getFips()) {
common.skip('BF-ECB is not FIPS 140-2 compatible');
}
if (hasOpenSSL(3)) {
common.skip('Blowfish is only available with the legacy provider in ' +
'OpenSSl 3.x');
}
if (!crypto.getCiphers().includes('BF-ECB')) {
common.skip('BF-ECB cipher is not available');
}
const assert = require('assert');
// Testing whether EVP_CipherInit_ex is functioning correctly.
// Reference: bug#1997
{
const encrypt =
crypto.createCipheriv('BF-ECB', 'SomeRandomBlahz0c5GZVnR', '');
let hex = encrypt.update('Hello World!', 'ascii', 'hex');
hex += encrypt.final('hex');
assert.strictEqual(hex.toUpperCase(), '6D385F424AAB0CFBF0BB86E07FFB7D71');
}
{
const decrypt =
crypto.createDecipheriv('BF-ECB', 'SomeRandomBlahz0c5GZVnR', '');
let msg = decrypt.update('6D385F424AAB0CFBF0BB86E07FFB7D71', 'hex', 'ascii');
msg += decrypt.final('ascii');
assert.strictEqual(msg, 'Hello World!');
}
test/parallel/test-crypto-encap-decap.js
+1 -6
View File
@@ -16,11 +16,6 @@ const { promisify } = require('util');
const isBoringSSL = commonIsBoringSSL;
const isFips = hasFIPS(3);
if (!hasOpenSSL(3) && !isBoringSSL) {
assert.throws(() => crypto.encapsulate(), { code: 'ERR_CRYPTO_KEM_NOT_SUPPORTED' });
return;
}
assert.throws(() => crypto.encapsulate(), { code: 'ERR_INVALID_ARG_TYPE',
message: /The "key" argument must be of type/ });
assert.throws(() => crypto.decapsulate(), { code: 'ERR_INVALID_ARG_TYPE',
@@ -28,7 +23,7 @@ assert.throws(() => crypto.decapsulate(), { code: 'ERR_INVALID_ARG_TYPE',
const keys = {
'rsa': {
supported: hasOpenSSL(3), // RSASVE was added in 3.0
supported: !isBoringSSL, // BoringSSL does not support RSASVE
publicKey: fixtures.readKey('rsa_public_2048.pem', 'ascii'),
privateKey: fixtures.readKey('rsa_private_2048.pem', 'ascii'),
sharedSecretLength: 256,
test/parallel/test-crypto-fips-indicator-strict.js
+1 -1
View File
@@ -31,7 +31,7 @@ const mode = process.env.NODE_TEST_FIPS_FORCE_MODE;
if (!hasOpenSSL(3, 4)) {
common.skip('OpenSSL 3.4 or later is required');
} else if (!hasFIPS(3, 4)) {
common.skip('an active OpenSSL 3.4+ FIPS provider is required');
common.skip('an active OpenSSL FIPS provider is required');
} else if (mode === 'provider') {
assertSerializedMode(mode);
assert.strictEqual(
test/parallel/test-crypto-getcipherinfo.js
+2 -2
View File
@@ -10,7 +10,7 @@ const {
getCiphers,
getCipherInfo,
} = require('crypto');
const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
const assert = require('assert');
@@ -18,7 +18,7 @@ const ciphers = getCiphers();
assert.strictEqual(getCipherInfo(-1), undefined);
assert.strictEqual(getCipherInfo('cipher that does not exist'), undefined);
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
assert.deepStrictEqual(
ciphers.filter((cipher) => cipher.includes('cbc-hmac')), []);
for (const cipher of [
test/parallel/test-crypto-hkdf.js
+2 -5
View File
@@ -13,7 +13,7 @@ const {
hkdfSync,
getHashes
} = require('crypto');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
{
assert.throws(() => hkdf(), {
@@ -142,9 +142,6 @@ const algorithms = [
['sha256', '', 'salt', '', 10],
['sha512', 'secret', 'salt', '', 15],
];
if (!hasOpenSSL(3) && !isBoringSSL)
algorithms.push(['whirlpool', 'secret', '', 'info', 20]);
algorithms.forEach(([ hash, secret, salt, info, length ]) => {
{
const syncResult = hkdfSync(hash, secret, salt, info, length);
@@ -233,7 +230,7 @@ algorithms.forEach(([ hash, secret, salt, info, length ]) => {
});
if (!hasOpenSSL(3)) {
if (isBoringSSL) {
const kKnownUnsupported = ['shake128', 'shake256'];
for (const hash of getHashes()) {
if (kKnownUnsupported.includes(hash)) continue;
test/parallel/test-crypto-hmac.js
-13
View File
@@ -69,19 +69,6 @@ function testHmac(algo, key, data, expected) {
'19fd6e1ba73d9ed2224dd5094a71babe85d9a892');
}
{
// Historically, dss1 and DSS1 are SHA-1 aliases.
const key = '0123456789abcdef';
const expected =
crypto.createHmac('sha1', key).update('data').digest('hex');
for (const algo of ['dss1', 'DSS1']) {
assert.strictEqual(
crypto.createHmac(algo, key).update('data').digest('hex'),
expected);
}
}
// Test HMAC (Wikipedia Test Cases)
const wikipedia = [
{
test/parallel/test-crypto-job-error-parity.js
+2 -2
View File
@@ -8,7 +8,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasOpenSSL, hasFIPS } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const crypto = require('crypto');
const fixtures = require('../common/fixtures');
@@ -195,7 +195,7 @@ const data = Buffer.from('test data');
}
// === crypto.encapsulate / crypto.decapsulate ===
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
// KEM: Decapsulate with wrong private key type
{
const rsaPublicKey = crypto.createPublicKey(
test/parallel/test-crypto-kem-shared-key.js
+1 -4
View File
@@ -18,9 +18,6 @@ const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
const fixtures = require('../common/fixtures');
const { subtle } = globalThis.crypto;
if (!hasOpenSSL(3) && !isBoringSSL)
common.skip('requires OpenSSL >= 3 or BoringSSL');
const encapsulateAsync = promisify(encapsulate);
const decapsulateAsync = promisify(decapsulate);
@@ -103,7 +100,7 @@ async function testKeys(keys) {
async function runMain() {
const types = [];
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
types.push(['rsa', 'rsa', 256, 256]);
}
if (hasOpenSSL(3, 2) && !hasFIPS(3)) {
test/parallel/test-crypto-key-encoding-provider-cipher.js
+2 -2
View File
@@ -4,8 +4,8 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
if (isBoringSSL || !hasOpenSSL(3))
const { hasFIPS, isBoringSSL } = require('../common/crypto');
if (isBoringSSL)
common.skip('OpenSSL providers are required');
const assert = require('assert');
test/parallel/test-crypto-key-objects.js
+12 -22
View File
@@ -25,7 +25,6 @@ const {
} = require('crypto');
const {
hasOpenSSL,
hasFIPS,
isBoringSSL,
} = require('../common/crypto');
@@ -350,20 +349,14 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
// This should not cause a crash: https://github.com/nodejs/node/issues/25247
assert.throws(() => {
createPrivateKey({ key: '' });
}, hasOpenSSL(3) ? {
message: 'error:1E08010C:DECODER routines::unsupported',
} : isBoringSSL ? {
}, isBoringSSL ? {
message: 'error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE',
code: 'ERR_OSSL_PEM_NO_START_LINE',
reason: 'NO_START_LINE',
library: 'PEM routines',
function: 'OPENSSL_internal',
} : {
message: 'error:0909006C:PEM routines:get_name:no start line',
code: 'ERR_OSSL_PEM_NO_START_LINE',
reason: 'no start line',
library: 'PEM routines',
function: 'get_name',
message: 'error:1E08010C:DECODER routines::unsupported',
});
// This should not abort either: https://github.com/nodejs/node/issues/29904
@@ -382,15 +375,12 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
type: 'pkcs1'
});
createPrivateKey({ key, format: 'der', type: 'pkcs1' });
}, hasOpenSSL(3) ? {
message: /error:1E08010C:DECODER routines::unsupported/,
library: 'DECODER routines'
} : isBoringSSL ? {
}, isBoringSSL ? {
library: 'public key routines',
message: 'error:06000066:public key routines:OPENSSL_internal:DECODE_ERROR'
} : {
message: /asn1 encoding/,
library: 'asn1 encoding routines'
message: /error:1E08010C:DECODER routines::unsupported/,
library: 'DECODER routines'
});
}
@@ -791,14 +781,14 @@ for (const info of [
{
// Reading an encrypted key without a passphrase should fail.
assert.throws(() => createPrivateKey(privateDsa), hasOpenSSL(3) ? {
name: 'Error',
message: 'error:07880109:common libcrypto routines::interrupted or ' +
'cancelled',
} : {
assert.throws(() => createPrivateKey(privateDsa), isBoringSSL ? {
name: 'TypeError',
code: 'ERR_MISSING_PASSPHRASE',
message: 'Passphrase required for encrypted key'
} : {
name: 'Error',
message: 'error:07880109:common libcrypto routines::interrupted or ' +
'cancelled',
});
// Reading an encrypted key with a passphrase that exceeds OpenSSL's buffer
@@ -807,10 +797,10 @@ for (const info of [
key: privateDsa,
format: 'pem',
passphrase: Buffer.alloc(1025, 'a')
}), hasOpenSSL(3) ? { name: 'Error' } : {
}), isBoringSSL ? {
code: 'ERR_OSSL_PEM_BAD_PASSWORD_READ',
name: 'Error'
});
} : { name: 'Error' });
// The buffer has a size of 1024 bytes, so this passphrase should be permitted
// (but will fail decryption).
test/parallel/test-crypto-key-store-pkcs11.js
+3 -3
View File
@@ -3,9 +3,9 @@
const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasOpenSSL } = require('../common/crypto');
if (!hasOpenSSL(3, 0))
common.skip('requires OpenSSL 3.x');
const { isBoringSSL } = require('../common/crypto');
if (isBoringSSL)
common.skip('OpenSSL provider support is required');
// The PKCS#11 token, the OpenSSL configuration that activates a provider for
// it, and the PIN that unlocks it are all provided by the environment. See
test/parallel/test-crypto-key-store.js
+3 -3
View File
@@ -2,9 +2,9 @@
const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasFIPS, hasOpenSSL } = require('../common/crypto');
if (!hasOpenSSL(3))
common.skip('requires OpenSSL 3.x');
const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
if (isBoringSSL)
common.skip('OpenSSL provider support is required');
// Verifies that crypto.createPrivateKey() can pass a WHATWG URL (here a file:
// URI) to an OpenSSL STORE loader, and that the resulting KeyObject works for
test/parallel/test-crypto-keygen-async-dsa-key-object.js
+4 -4
View File
@@ -4,7 +4,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
if (isBoringSSL)
common.skip('not supported by BoringSSL');
@@ -17,20 +17,20 @@ const {
// Test async DSA key object generation.
{
generateKeyPair('dsa', {
modulusLength: hasOpenSSL(3) ? 2048 : 512,
modulusLength: 2048,
divisorLength: 256
}, common.mustSucceed((publicKey, privateKey) => {
assert.strictEqual(publicKey.type, 'public');
assert.strictEqual(publicKey.asymmetricKeyType, 'dsa');
assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
modulusLength: hasOpenSSL(3) ? 2048 : 512,
modulusLength: 2048,
divisorLength: 256
});
assert.strictEqual(privateKey.type, 'private');
assert.strictEqual(privateKey.asymmetricKeyType, 'dsa');
assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
modulusLength: hasOpenSSL(3) ? 2048 : 512,
modulusLength: 2048,
divisorLength: 256
});
}));
test/parallel/test-crypto-keygen-async-dsa.js
+3 -5
View File
@@ -9,7 +9,6 @@ const {
assertApproximateSize,
testSignVerify,
spkiExp,
hasOpenSSL,
} = require('../common/crypto');
if (isBoringSSL)
@@ -19,7 +18,6 @@ const assert = require('assert');
const {
generateKeyPair,
} = require('crypto');
// Test async DSA key generation.
{
const privateKeyEncoding = {
@@ -28,7 +26,7 @@ const {
};
generateKeyPair('dsa', {
modulusLength: hasOpenSSL(3) ? 2048 : 512,
modulusLength: 2048,
divisorLength: 256,
publicKeyEncoding: {
type: 'spki',
@@ -45,8 +43,8 @@ const {
// The private key is DER-encoded.
assert(Buffer.isBuffer(privateKeyDER));
assertApproximateSize(publicKey, hasOpenSSL(3) ? 1194 : 440);
assertApproximateSize(privateKeyDER, hasOpenSSL(3) ? 721 : 336);
assertApproximateSize(publicKey, 1194);
assertApproximateSize(privateKeyDER, 721);
// Since the private key is encrypted, signing shouldn't work anymore.
assert.throws(() => {
test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
+1 -7
View File
@@ -9,7 +9,6 @@ const {
testSignVerify,
spkiExp,
pkcs8EncExp,
hasOpenSSL,
} = require('../common/crypto');
if (isBoringSSL)
@@ -19,7 +18,6 @@ const assert = require('assert');
const {
generateKeyPair,
} = require('crypto');
// Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
// private key with paramEncoding explicit.
{
@@ -44,13 +42,9 @@ const {
// Since the private key is encrypted, signing shouldn't work anymore.
assert.throws(() => testSignVerify(publicKey, privateKey),
hasOpenSSL(3) ? {
{
message: 'error:07880109:common libcrypto ' +
'routines::interrupted or cancelled'
} : {
name: 'TypeError',
code: 'ERR_MISSING_PASSPHRASE',
message: 'Passphrase required for encrypted key'
});
testSignVerify(publicKey, {
test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
+1 -6
View File
@@ -10,7 +10,6 @@ const {
testSignVerify,
spkiExp,
sec1EncExp,
hasOpenSSL,
} = require('../common/crypto');
if (isBoringSSL)
@@ -50,13 +49,9 @@ const {
// Since the private key is encrypted, signing shouldn't work anymore.
assert.throws(() => testSignVerify(publicKey, privateKey),
hasOpenSSL(3) ? {
{
message: 'error:07880109:common libcrypto ' +
'routines::interrupted or cancelled'
} : {
name: 'TypeError',
code: 'ERR_MISSING_PASSPHRASE',
message: 'Passphrase required for encrypted key'
});
testSignVerify(publicKey, { key: privateKey, passphrase: 'secret' });
test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
+5 -5
View File
@@ -12,7 +12,7 @@ const {
testSignVerify,
spkiExp,
pkcs8EncExp,
hasOpenSSL,
isBoringSSL,
} = require('../common/crypto');
// Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
@@ -39,13 +39,13 @@ const {
// Since the private key is encrypted, signing shouldn't work anymore.
assert.throws(() => testSignVerify(publicKey, privateKey),
hasOpenSSL(3) ? {
message: 'error:07880109:common libcrypto ' +
'routines::interrupted or cancelled'
} : {
isBoringSSL ? {
name: 'TypeError',
code: 'ERR_MISSING_PASSPHRASE',
message: 'Passphrase required for encrypted key'
} : {
message: 'error:07880109:common libcrypto ' +
'routines::interrupted or cancelled'
});
testSignVerify(publicKey, {
test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
+5 -5
View File
@@ -13,7 +13,7 @@ const {
testSignVerify,
spkiExp,
sec1EncExp,
hasOpenSSL,
isBoringSSL,
} = require('../common/crypto');
{
@@ -45,13 +45,13 @@ const {
// Since the private key is encrypted, signing shouldn't work anymore.
assert.throws(() => testSignVerify(publicKey, privateKey),
hasOpenSSL(3) ? {
message: 'error:07880109:common libcrypto ' +
'routines::interrupted or cancelled'
} : {
isBoringSSL ? {
name: 'TypeError',
code: 'ERR_MISSING_PASSPHRASE',
message: 'Passphrase required for encrypted key'
} : {
message: 'error:07880109:common libcrypto ' +
'routines::interrupted or cancelled'
});
testSignVerify(publicKey, { key: privateKey, passphrase: 'secret' });
test/parallel/test-crypto-keygen-async-rsa.js
+6 -6
View File
@@ -14,7 +14,7 @@ const {
testEncryptDecrypt,
testSignVerify,
pkcs1EncExp,
hasOpenSSL,
isBoringSSL,
} = require('../common/crypto');
// Test async RSA key generation with an encrypted private key.
@@ -51,14 +51,14 @@ const {
type: 'pkcs1',
format: 'der',
};
const expectedError = hasOpenSSL(3) ? {
name: 'Error',
message: 'error:07880109:common libcrypto routines::interrupted or ' +
'cancelled'
} : {
const expectedError = isBoringSSL ? {
name: 'TypeError',
code: 'ERR_MISSING_PASSPHRASE',
message: 'Passphrase required for encrypted key'
} : {
name: 'Error',
message: 'error:07880109:common libcrypto routines::interrupted or ' +
'cancelled'
};
assert.throws(() => testSignVerify(publicKey, privateKey), expectedError);
test/parallel/test-crypto-keygen-bit-length.js
+12 -16
View File
@@ -6,7 +6,6 @@ if (!common.hasCrypto)
const {
isBoringSSL,
hasOpenSSL,
hasFIPS,
} = require('../common/crypto');
@@ -18,7 +17,6 @@ const assert = require('assert');
const {
generateKeyPair,
} = require('crypto');
const fips3 = hasFIPS(3);
// This tests check that generateKeyPair returns correct bit length in
@@ -49,18 +47,16 @@ const fips3 = hasFIPS(3);
assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 513);
}));
if (hasOpenSSL(3)) {
generateKeyPair('dsa', {
modulusLength: 2049,
divisorLength: 256,
}, common.mustCall((err, publicKey, privateKey) => {
if (fips3) {
assert.strictEqual(err?.code, 'ERR_OSSL_DSA_BAD_FFC_PARAMETERS');
return;
}
assert.ifError(err);
assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 2049);
assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 2049);
}));
}
generateKeyPair('dsa', {
modulusLength: 2049,
divisorLength: 256,
}, common.mustCall((err, publicKey, privateKey) => {
if (fips3) {
assert.strictEqual(err?.code, 'ERR_OSSL_DSA_BAD_FFC_PARAMETERS');
return;
}
assert.ifError(err);
assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 2049);
assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 2049);
}));
}
test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
+6 -6
View File
@@ -12,7 +12,7 @@ const {
const {
hasFIPS,
testSignVerify,
hasOpenSSL,
isBoringSSL,
} = require('../common/crypto');
const fips4 = hasFIPS(4);
@@ -56,14 +56,14 @@ for (const type of ['pkcs1', 'pkcs8']) {
// the key, and not specifying a passphrase should fail when decoding it.
assert.throws(() => {
return testSignVerify(publicKey, privateKey);
}, hasOpenSSL(3) ? {
name: 'Error',
code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED',
message: 'error:07880109:common libcrypto routines::interrupted or cancelled'
} : {
}, isBoringSSL ? {
name: 'TypeError',
code: 'ERR_MISSING_PASSPHRASE',
message: 'Passphrase required for encrypted key'
} : {
name: 'Error',
code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED',
message: 'error:07880109:common libcrypto routines::interrupted or cancelled'
});
}));
}
test/parallel/test-crypto-keygen-missing-oid.js
+22 -24
View File
@@ -11,36 +11,34 @@ const {
getCurves,
} = require('crypto');
const { hasOpenSSL, hasFIPS } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
// This test creates EC key pairs on curves without associated OIDs.
// Specifying a key encoding should not crash.
{
if (process.versions.openssl >= '1.1.1i') {
for (const namedCurve of ['Oakley-EC2N-3', 'Oakley-EC2N-4']) {
if (!getCurves().includes(namedCurve))
continue;
for (const namedCurve of ['Oakley-EC2N-3', 'Oakley-EC2N-4']) {
if (!getCurves().includes(namedCurve))
continue;
const expectedErrorCode =
hasFIPS(3) ? 'ERR_OSSL_EC_UNKNOWN_GROUP' :
hasOpenSSL(3) ? 'ERR_OSSL_MISSING_OID' : 'ERR_OSSL_EC_MISSING_OID';
const params = {
namedCurve,
publicKeyEncoding: {
format: 'der',
type: 'spki'
}
};
const expectedErrorCode =
hasFIPS(3) ? 'ERR_OSSL_EC_UNKNOWN_GROUP' :
isBoringSSL ? 'ERR_OSSL_EC_MISSING_OID' : 'ERR_OSSL_MISSING_OID';
const params = {
namedCurve,
publicKeyEncoding: {
format: 'der',
type: 'spki'
}
};
assert.throws(() => {
generateKeyPairSync('ec', params);
}, {
code: expectedErrorCode
});
assert.throws(() => {
generateKeyPairSync('ec', params);
}, {
code: expectedErrorCode
});
generateKeyPair('ec', params, common.mustCall((err) => {
assert.strictEqual(err.code, expectedErrorCode);
}));
}
generateKeyPair('ec', params, common.mustCall((err) => {
assert.strictEqual(err.code, expectedErrorCode);
}));
}
}
test/parallel/test-crypto-keygen.js
+2 -11
View File
@@ -14,11 +14,7 @@ const {
} = require('crypto');
const { inspect } = require('util');
const {
hasOpenSSL,
isBoringSSL: commonIsBoringSSL,
} = require('../common/crypto');
const isBoringSSL = commonIsBoringSSL;
const { isBoringSSL } = require('../common/crypto');
// Test invalid parameter encoding.
{
@@ -379,12 +375,7 @@ const isBoringSSL = commonIsBoringSSL;
}
// Test invalid exponents. (caught by OpenSSL)
let invalidExponentError = /bad e value/;
if (isBoringSSL) {
invalidExponentError = /BAD_E_VALUE/;
} else if (hasOpenSSL(3)) {
invalidExponentError = /exponent/;
}
const invalidExponentError = isBoringSSL ? /BAD_E_VALUE/ : /exponent/;
for (const publicExponent of [1, 1 + 0x10001]) {
generateKeyPair('rsa', {
modulusLength: 4096,
test/parallel/test-crypto-mac-errors.js
+3 -3
View File
@@ -6,10 +6,10 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3) || isBoringSSL) {
common.skip('OpenSSL 3 EVP_MAC support is required');
if (isBoringSSL) {
common.skip('OpenSSL EVP_MAC support is required');
}
const assert = require('node:assert');
test/parallel/test-crypto-mac-unsupported.js
+2 -2
View File
@@ -6,9 +6,9 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
if (hasOpenSSL(3) && !isBoringSSL) {
if (!isBoringSSL) {
common.skip('this test requires a build without EVP_MAC support');
}
test/parallel/test-crypto-mac-vectors.js
+3 -3
View File
@@ -8,10 +8,10 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3) || isBoringSSL) {
common.skip('OpenSSL 3 EVP_MAC support is required');
if (isBoringSSL) {
common.skip('OpenSSL EVP_MAC support is required');
}
const assert = require('node:assert');
test/parallel/test-crypto-mac.js
+3 -3
View File
@@ -8,10 +8,10 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3) || isBoringSSL) {
common.skip('OpenSSL 3 EVP_MAC support is required');
if (isBoringSSL) {
common.skip('OpenSSL EVP_MAC support is required');
}
const assert = require('node:assert');
test/parallel/test-crypto-negative-zero.js
+3 -3
View File
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const crypto = require('crypto');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
function getOutcome(fn) {
try {
@@ -88,9 +88,9 @@ function assertSameErrorOrSuccess(actual, expected) {
);
}
if (!hasOpenSSL(3)) {
if (isBoringSSL) {
common.printSkipMessage(
'Skipping DSA divisorLength 0 key generation on OpenSSL 1.1.1');
'BoringSSL does not support DSA key pair generation');
} else {
assertSameErrorOrSuccess(
getOutcome(() => crypto.generateKeyPairSync('dsa', {
test/parallel/test-crypto-no-algorithm.js
+3 -3
View File
@@ -4,10 +4,10 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasOpenSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3))
common.skip('this test requires OpenSSL 3.x');
if (isBoringSSL)
common.skip('this test requires OpenSSL');
const assert = require('node:assert/strict');
const crypto = require('node:crypto');
test/parallel/test-crypto-padding.js
+6 -6
View File
@@ -26,7 +26,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const crypto = require('crypto');
const { hasOpenSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
// Input data.
const ODD_LENGTH_PLAIN = 'Hello node world!';
@@ -83,14 +83,14 @@ assert.strictEqual(enc(EVEN_LENGTH_PLAIN, true), EVEN_LENGTH_ENCRYPTED);
assert.throws(function() {
// Input must have block length %.
enc(ODD_LENGTH_PLAIN, false);
}, hasOpenSSL(3) ? {
message: /wrong[\s_]final[\s_]block[\s_]length/i,
code: /ERR_OSSL(_EVP)?_WRONG_FINAL_BLOCK_LENGTH/,
reason: /wrong[\s_]final[\s_]block[\s_]length/i,
} : {
}, isBoringSSL ? {
message: /data[\s_]not[\s_]multiple[\s_]of[\s_]block[\s_]length/i,
code: /ERR_OSSL(_EVP)?_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH/,
reason: /data[\s_]not[\s_]multiple[\s_]of[\s_]block[\s_]length/i,
} : {
message: /wrong[\s_]final[\s_]block[\s_]length/i,
code: /ERR_OSSL(_EVP)?_WRONG_FINAL_BLOCK_LENGTH/,
reason: /wrong[\s_]final[\s_]block[\s_]length/i,
}
);
test/parallel/test-crypto-pbkdf2.js
+2 -2
View File
@@ -6,8 +6,8 @@ if (!common.hasCrypto)
const assert = require('assert');
const crypto = require('crypto');
const {
hasOpenSSL,
hasFIPS,
isBoringSSL,
} = require('../common/crypto');
const fips4 = hasFIPS(4);
@@ -335,7 +335,7 @@ assert.throws(
}
);
if (!hasOpenSSL(3)) {
if (isBoringSSL) {
const kNotPBKDF2Supported = ['shake128', 'shake256'];
crypto.getHashes()
.filter((hash) => !kNotPBKDF2Supported.includes(hash))
test/parallel/test-crypto-pkcs12.js
+2 -2
View File
@@ -5,7 +5,7 @@ if (!common.hasCrypto) common.skip('missing crypto');
const assert = require('assert');
const crypto = require('crypto');
const fixtures = require('../common/fixtures');
const { hasOpenSSL3, hasFIPS } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
const fips3 = hasFIPS(3);
@@ -140,7 +140,7 @@ if (!fips3) {
assert.ok(additionalCertificates[0] instanceof crypto.X509Certificate);
}
if (hasOpenSSL3) {
if (!isBoringSSL) {
// Legacy algorithms (RC2-40-CBC) throw a recognizable, actionable error
// rather than a bare OpenSSL string. Mirrors the behavior added for the
// TLS path in https://github.com/nodejs/node/pull/54485.
test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
+2 -2
View File
@@ -102,12 +102,12 @@ for (const [asymmetricKeyType, pubLen] of [
if (!hasOpenSSL(3, 5) && !isBoringSSL) {
assert.throws(() => createPublicKey(keys.public), {
code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
code: 'ERR_OSSL_EVP_DECODE_ERROR',
});
for (const pem of [keys.private, keys.private_seed_only, keys.private_priv_only]) {
assert.throws(() => createPrivateKey(pem), {
code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
code: 'ERR_OSSL_UNSUPPORTED',
});
}
} else {
test/parallel/test-crypto-pqc-key-objects-ml-kem.js
+2 -2
View File
@@ -102,12 +102,12 @@ for (const [asymmetricKeyType, pubLen] of [
if (!hasOpenSSL(3, 5) && !isBoringSSL) {
assert.throws(() => createPublicKey(keys.public), {
code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
code: 'ERR_OSSL_EVP_DECODE_ERROR',
});
for (const pem of [keys.private, keys.private_seed_only, keys.private_priv_only]) {
assert.throws(() => createPrivateKey(pem), {
code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
code: 'ERR_OSSL_UNSUPPORTED',
});
}
} else if (isBoringSSL && asymmetricKeyType === 'ml-kem-512') {
test/parallel/test-crypto-pqc-key-objects-slh-dsa.js
+3 -3
View File
@@ -4,7 +4,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasOpenSSL } = require('../common/crypto');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const {
@@ -101,11 +101,11 @@ for (const asymmetricKeyType of [
if (!hasOpenSSL(3, 5)) {
assert.throws(() => createPublicKey(keys.public), {
code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
code: isBoringSSL ? 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM' : 'ERR_OSSL_EVP_DECODE_ERROR',
});
assert.throws(() => createPrivateKey(keys.private), {
code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
code: isBoringSSL ? 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM' : 'ERR_OSSL_UNSUPPORTED',
});
} else {
const publicKey = createPublicKey(keys.public);
test/parallel/test-crypto-prime.js
+3 -2
View File
@@ -5,6 +5,7 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('assert');
const { isBoringSSL } = require('../common/crypto');
const {
generatePrime,
@@ -165,7 +166,7 @@ generatePrime(
// The behavior when specifying only add without rem should depend on the
// safe option.
if (process.versions.openssl >= '1.1.1f') {
if (!isBoringSSL) {
generatePrime(128, {
bigint: true,
add: 5n
@@ -215,7 +216,7 @@ generatePrime(
code: 'ERR_OUT_OF_RANGE'
});
if (process.versions.openssl >= '1.1.1f') {
if (!isBoringSSL) {
// This is possible and allowed (but makes little sense).
assert.strictEqual(generatePrimeSync(4, {
add: 15n,
test/parallel/test-crypto-private-decrypt-gh32240.js
+4 -4
View File
@@ -15,8 +15,8 @@ const {
} = require('crypto');
const {
hasOpenSSL,
hasFIPS,
isBoringSSL,
} = require('../common/crypto');
const fips3 = hasFIPS(3);
@@ -64,8 +64,8 @@ function decrypt(key) {
}
decrypt(pkey);
assert.throws(() => decrypt(pkeyEncrypted), hasOpenSSL(3) ?
assert.throws(() => decrypt(pkeyEncrypted), isBoringSSL ?
{ code: 'ERR_MISSING_PASSPHRASE' } :
{ message: 'error:07880109:common libcrypto routines::interrupted or ' +
'cancelled' } :
{ code: 'ERR_MISSING_PASSPHRASE' });
'cancelled' });
decrypt(pkey); // Should not throw.
test/parallel/test-crypto-provider-cache-snapshot.js
+3 -3
View File
@@ -5,13 +5,13 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('node:assert');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
const fixtures = require('../common/fixtures');
const tmpdir = require('../common/tmpdir');
const { buildSnapshot, runWithSnapshot } = require('../common/snapshot');
if (!hasOpenSSL(3) || isBoringSSL)
common.skip('this test requires OpenSSL 3.x');
if (isBoringSSL)
common.skip('OpenSSL provider support is required');
const entry = fixtures.path('snapshot', 'crypto-provider-cache.js');
const buildEnv = {
test/parallel/test-crypto-provider-cache.js
+3 -3
View File
@@ -5,9 +5,9 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3) || isBoringSSL)
common.skip('this test requires OpenSSL 3 provider support');
const { isBoringSSL } = require('../common/crypto');
if (isBoringSSL)
common.skip('this test requires OpenSSL provider support');
const assert = require('node:assert');
const crypto = require('node:crypto');
test/parallel/test-crypto-provider-hash-options.js
+1 -1
View File
@@ -11,7 +11,7 @@ if (!common.hasCrypto) {
if (Number(process.versions.openssl.split('.')[0]) < 4 ||
isBoringSSL) {
common.skip('OpenSSL 4 provider support is required');
common.skip('OpenSSL 4.0 or later is required');
}
const assert = require('node:assert');
test/parallel/test-crypto-provider-hashes.js
+3 -3
View File
@@ -26,10 +26,10 @@ const {
sign,
verify,
} = require('node:crypto');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3) || isBoringSSL) {
common.skip('OpenSSL 3 provider support is required');
if (isBoringSSL) {
common.skip('OpenSSL provider support is required');
}
const { internalBinding } = require('internal/test/binding');
test/parallel/test-crypto-publicDecrypt-fails-first-time.js
+3 -3
View File
@@ -7,10 +7,10 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
const { hasOpenSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3)) {
common.skip('only openssl3'); // https://github.com/nodejs/node/pull/42793#issuecomment-1107491901
if (isBoringSSL) {
common.skip('this test is not supported with BoringSSL'); // https://github.com/nodejs/node/pull/42793#issuecomment-1107491901
}
const assert = require('assert');
test/parallel/test-crypto-rsa-dsa.js
+15 -43
View File
@@ -16,9 +16,7 @@ const {
} = require('../common/crypto');
const fips3 = hasFIPS(3);
const fips35 = hasFIPS(3, 5);
const fips30 = fips3 && !fips35;
const fips4 = hasFIPS(4);
const fipsDigestErrorCode = 'ERR_OSSL_DIGEST_NOT_ALLOWED';
const wrongPassphrase = 'wrong-password';
// Test certificates
@@ -40,34 +38,25 @@ const dsaPkcs8KeyPem = fixtures.readKey('dsa_private_pkcs8.pem');
const ec = new TextEncoder();
const openssl1DecryptError = {
message: 'error:06065064:digital envelope routines:EVP_DecryptFinal_ex:' +
'bad decrypt',
code: 'ERR_OSSL_EVP_BAD_DECRYPT',
reason: 'bad decrypt',
function: 'EVP_DecryptFinal_ex',
library: 'digital envelope routines',
};
const decryptError = fips4 ?
{ code: 'ERR_OSSL_BAD_DECRYPT' } : hasOpenSSL(3) ?
{ message: 'error:1C800064:Provider routines::bad decrypt' } :
isBoringSSL ? {
message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
code: 'ERR_OSSL_BAD_DECRYPT',
reason: 'BAD_DECRYPT',
function: 'OPENSSL_internal',
library: 'Cipher functions',
} :
openssl1DecryptError;
{ code: 'ERR_OSSL_BAD_DECRYPT' } :
isBoringSSL ? {
message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
code: 'ERR_OSSL_BAD_DECRYPT',
reason: 'BAD_DECRYPT',
function: 'OPENSSL_internal',
library: 'Cipher functions',
} : {
message: 'error:1C800064:Provider routines::bad decrypt',
};
const decryptPrivateKeyError = fips4 ? {
code: 'ERR_OSSL_BAD_DECRYPT',
} : hasOpenSSL(3) ? {
message: 'error:1C800064:Provider routines::bad decrypt',
} : isBoringSSL ? {
message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
} : openssl1DecryptError;
} : {
message: 'error:1C800064:Provider routines::bad decrypt',
};
function getBufferCopy(buf) {
return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
@@ -168,10 +157,8 @@ function getBufferCopy(buf) {
}, encryptedBuffer);
assert.strictEqual(decryptedBufferWithPassword.toString(), input);
// Now with RSA_NO_PADDING. Plaintext needs to match key size.
// OpenSSL 3.x has a rsa_check_padding that will cause an error if
// RSA_NO_PADDING is used.
if (!hasOpenSSL(3)) {
// BoringSSL does not apply OpenSSL's rsa_check_padding validation here.
if (isBoringSSL) {
{
const plaintext = 'x'.repeat(rsaKeySize / 8);
encryptedBuffer = crypto.privateEncrypt({
@@ -541,21 +528,6 @@ if (!isBoringSSL) {
assert.strictEqual(verify.verify(dsaPubPem, signature, 'hex'), true);
// Test the legacy 'DSS1' name.
const sign2 = crypto.createSign('DSS1');
sign2.update(input);
if (fips30) {
assert.throws(() => sign2.sign(dsaKeyPem, 'hex'), {
code: fipsDigestErrorCode,
});
} else {
const signature2 = sign2.sign(dsaKeyPem, 'hex');
const verify2 = crypto.createVerify('DSS1');
verify2.update(input);
assert.strictEqual(verify2.verify(dsaPubPem, signature2, 'hex'), true);
}
} else {
common.printSkipMessage('Skipping unsupported DSA test case');
}
test/parallel/test-crypto-rsa-multiprime-jwk.js
+2 -2
View File
@@ -6,13 +6,13 @@ if (!common.hasCrypto)
const assert = require('assert');
const fixtures = require('../common/fixtures');
const { hasFIPS } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
const {
createPrivateKey,
} = require('crypto');
const { subtle } = globalThis.crypto;
if (process.features.openssl_is_boringssl)
if (isBoringSSL)
common.skip('multi-prime RSA is not available with BoringSSL');
if (hasFIPS())
common.skip('multi-prime RSA is not available in FIPS mode');
test/parallel/test-crypto-rsa-pss-parameters.js
+3 -3
View File
@@ -2,9 +2,9 @@
const common = require('../common');
if (!common.hasCrypto) common.skip('missing crypto');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3) || isBoringSSL)
common.skip('requires OpenSSL 3 provider support');
const { isBoringSSL } = require('../common/crypto');
if (isBoringSSL)
common.skip('requires OpenSSL provider support');
const assert = require('assert');
const fixtures = require('../common/fixtures');
test/parallel/test-crypto-sec-level.js
+1 -1
View File
@@ -13,7 +13,7 @@ const assert = require('assert');
// are available by default. Different OpenSSL versions have different
// default security levels and we use this value to adjust what a test
// expects based on the security level. You can read more in
// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour
// https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour
// This test simply validates that we can get some value for the secLevel
// when needed by tests.
const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
test/parallel/test-crypto-secure-heap.js
+1 -4
View File
@@ -19,7 +19,6 @@ if (common.hasV8Sandbox) {
const {
isBoringSSL,
hasOpenSSL,
hasFIPS,
} = require('../common/crypto');
@@ -33,7 +32,6 @@ const fixtures = require('../common/fixtures');
const {
secureHeapUsed,
createDiffieHellman,
getFips,
} = require('crypto');
if (process.argv[2] === 'child') {
@@ -47,8 +45,7 @@ if (process.argv[2] === 'child') {
assert.strictEqual(a.used, 0);
{
const size = hasFIPS(3) ?
2048 : (getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
const size = hasFIPS(3) ? 2048 : 1024;
const dh1 = createDiffieHellman(size);
const p1 = dh1.getPrime('buffer');
const dh2 = createDiffieHellman(p1, 'buffer');
test/parallel/test-crypto-sign-verify.js
+6 -15
View File
@@ -79,11 +79,9 @@ if (fips30) {
key: keyPem,
padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
});
}, { message: hasOpenSSL(3) ?
'error:1C8000A5:Provider routines::illegal or unsupported padding mode' :
isBoringSSL ?
'error:0600006d:public key routines:OPENSSL_internal:ILLEGAL_OR_UNSUPPORTED_PADDING_MODE' :
'bye, bye, error stack' });
}, { message: isBoringSSL ?
'error:0600006d:public key routines:OPENSSL_internal:ILLEGAL_OR_UNSUPPORTED_PADDING_MODE' :
'error:1C8000A5:Provider routines::illegal or unsupported padding mode' });
delete Object.prototype.opensslErrorStack;
}
@@ -374,19 +372,12 @@ assert.throws(
key: keyPem,
padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
});
}, hasOpenSSL(3) ? {
code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
message: /illegal or unsupported padding mode/,
} : isBoringSSL ? {
}, isBoringSSL ? {
code: 'ERR_OSSL_EVP_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
message: /ILLEGAL_OR_UNSUPPORTED_PADDING_MODE/,
} : {
code: 'ERR_OSSL_RSA_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
message: /illegal or unsupported padding mode/,
opensslErrorStack: [
'error:06089093:digital envelope routines:EVP_PKEY_CTX_ctrl:' +
'command not supported',
],
});
}
@@ -682,7 +673,7 @@ if (hasOpenSSL(3, 2)) {
// Preserve the current behavior from https://github.com/nodejs/node/issues/53761:
// one-shot verify does not accept SM2 signatures produced by the streaming path.
if (hasOpenSSL(3) && crypto.getHashes().includes('sm3')) {
if (!isBoringSSL && crypto.getHashes().includes('sm3')) {
const data = Buffer.from('AABB');
const privateKey = crypto.createPrivateKey(`-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQgbjCNHopgvyGVfLaP
test/parallel/test-crypto-stream.js
+1 -7
View File
@@ -28,7 +28,6 @@ if (!common.hasCrypto) {
const assert = require('assert');
const stream = require('stream');
const crypto = require('crypto');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
if (!crypto.getFips()) {
// Small stream to buffer converter
@@ -73,15 +72,10 @@ const cipher = crypto.createCipheriv('aes-128-cbc', key, iv);
const decipher = crypto.createDecipheriv('aes-128-cbc', badkey, iv);
cipher.pipe(decipher)
.on('error', common.expectsError((hasOpenSSL(3) || isBoringSSL) ? {
.on('error', common.expectsError({
message: /bad[\s_]decrypt/i,
library: /Provider routines|Cipher functions/,
reason: /bad[\s_]decrypt/i,
} : {
message: /bad[\s_]decrypt/i,
function: 'EVP_DecryptFinal_ex',
library: 'digital envelope routines',
reason: /bad[\s_]decrypt/i,
}));
cipher.end('Papaya!'); // Should not cause an unhandled exception.
test/parallel/test-crypto-x509.js
+3 -14
View File
@@ -31,7 +31,7 @@ const ca = readFileSync(fixtures.path('keys', 'ca1-cert.pem'));
const privateKey = createPrivateKey(key);
if (!isBoringSSL) {
const expectedPubkeys = hasOpenSSL(3) ? [
const expectedPubkeys = [
[
'rsa_pss_cert_2048.pem',
292,
@@ -42,17 +42,6 @@ if (!isBoringSSL) {
342,
'da0bcd53fbe3969c7cc2730f86abc34e0e1c340264bbdfa3faf01484c2eeece0',
],
] : [
[
'rsa_pss_cert_2048.pem',
294,
'4d4f2f076aced4f0df922b84b466b0a60ba4cb50a23d695ae12ddc5fff7aca14',
],
[
'rsa_pss_cert_2048_sha256_sha256_16.pem',
294,
'd37942c3bd02bc25c724fcd31efd647824e536c13d62d9ad0b5db8c0900d3cba',
],
];
for (const [name, length, digest] of expectedPubkeys) {
@@ -90,7 +79,7 @@ emailAddress=ry@tinyclouds.org`;
let infoAccessCheck = `OCSP - URI:http://ocsp.nodejs.org/
CA Issuers - URI:http://ca.nodejs.org/ca.cert`;
if (!hasOpenSSL(3))
if (isBoringSSL)
infoAccessCheck += '\n';
const der = Buffer.from(
@@ -519,7 +508,7 @@ UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0
assert.strictEqual(child.status, 0, child.stderr || child.stdout);
assert.throws(() => cert.publicKey, {
message: hasOpenSSL(3) ? /decode error/ : /wrong tag/,
message: /decode error/,
name: 'Error'
});
test/parallel/test-crypto.js
+7 -38
View File
@@ -29,7 +29,7 @@ const assert = require('assert');
const crypto = require('crypto');
const tls = require('tls');
const fixtures = require('../common/fixtures');
const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
const isFips = hasFIPS(3);
// Test Certificates
@@ -244,25 +244,16 @@ assert.throws(() => {
assert(Array.isArray(err.opensslErrorStack));
assert(err.opensslErrorStack.length > 0);
} else {
if (!hasOpenSSL(3))
assert.ok(!('opensslErrorStack' in err));
assert.throws(() => { throw err; }, hasOpenSSL(3) ? {
assert.throws(() => { throw err; }, {
name: 'Error',
message: 'error:02000070:rsa routines::digest too big for rsa key',
library: 'rsa routines',
} : {
name: 'Error',
message: /routines:RSA_sign:digest too big for rsa key$/,
library: /rsa routines/i,
function: 'RSA_sign',
reason: /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i,
code: 'ERR_OSSL_RSA_DIGEST_TOO_BIG_FOR_RSA_KEY'
});
}
return true;
});
if (!hasOpenSSL(3)) {
if (isBoringSSL) {
// The correct header inside `rsa_private_pkcs8_bad.pem` should have been
// -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----
// instead of
@@ -270,32 +261,10 @@ if (!hasOpenSSL(3)) {
const sha1_privateKey = fixtures.readKey('rsa_private_pkcs8_bad.pem',
'ascii');
if (isBoringSSL) {
// BoringSSL accepts the PKCS#8 payload despite the legacy PEM label.
const signature = crypto.createSign('sha1').sign(sha1_privateKey);
assert(Buffer.isBuffer(signature));
assert.strictEqual(signature.length, 256);
} else {
assert.throws(() => {
// This would inject errors onto OpenSSL's error stack
crypto.createSign('sha1').sign(sha1_privateKey);
}, (err) => {
// Do the standard checks, but then do some custom checks afterwards.
assert.throws(() => { throw err; }, {
message: 'error:0D0680A8:asn1 encoding routines:asn1_check_tlen:' +
'wrong tag',
library: 'asn1 encoding routines',
function: 'asn1_check_tlen',
reason: 'wrong tag',
code: 'ERR_OSSL_ASN1_WRONG_TAG',
});
// Throws crypto error, so there is an opensslErrorStack property.
// The openSSL stack should have content.
assert(Array.isArray(err.opensslErrorStack));
assert(err.opensslErrorStack.length > 0);
return true;
});
}
// BoringSSL accepts the PKCS#8 payload despite the legacy PEM label.
const signature = crypto.createSign('sha1').sign(sha1_privateKey);
assert(Buffer.isBuffer(signature));
assert.strictEqual(signature.length, 256);
}
// Make sure memory isn't released before being returned
test/parallel/test-diagnostics-channel-crypto-fips-indicator.js
+1 -1
View File
@@ -26,7 +26,7 @@ const channelName = 'crypto.fips.indicator';
if (!hasOpenSSL(3, 4)) {
common.skip('OpenSSL 3.4 or later is required');
} else if (!hasFIPS(3, 4)) {
common.skip('an active OpenSSL 3.4+ FIPS provider is required');
common.skip('an active OpenSSL FIPS provider is required');
} else if (!process.execArgv.includes('--enable-fips-indicator-events')) {
spawnSyncAndExitWithoutError(
process.execPath,
test/parallel/test-https-agent-session-eviction.js
+1 -1
View File
@@ -84,7 +84,7 @@ function second(server, session) {
// Offering the cached session to a server using another TLS version should
// not prevent a fresh connection.
req.on('response', common.mustCall(function(res) {
// The test is now complete for OpenSSL 1.1.0.
// The test is now complete.
server.close();
}));
test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js
+3 -12
View File
@@ -12,18 +12,9 @@ const fixtures = require('../common/fixtures');
if (!common.hasCrypto)
common.skip('missing crypto');
const crypto = require('crypto');
const { hasOpenSSL } = require('../common/crypto');
// See #37990 for details on why this is problematic with FIPS.
if (crypto.getFips() === 1 && !hasOpenSSL(3))
common.skip('Skipping as test uses non-fips compliant EC curve');
// This test will fail for OpenSSL < 1.1.1h
const minOpenSSL = 269488271;
if (crypto.constants.OPENSSL_VERSION_NUMBER < minOpenSSL)
common.skip('OpenSSL < 1.1.1h');
const { isBoringSSL } = require('../common/crypto');
if (isBoringSSL)
common.skip('not supported by BoringSSL');
const https = require('https');
const path = require('path');
test/parallel/test-permission-openssl-store.js
+3 -3
View File
@@ -4,9 +4,9 @@
const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasOpenSSL } = require('../common/crypto');
if (!hasOpenSSL(3))
common.skip('requires OpenSSL 3.x');
const { isBoringSSL } = require('../common/crypto');
if (isBoringSSL)
common.skip('OpenSSL provider support is required');
// Verifies the openssl.store permission: allowed when --allow-openssl-store is
// set, can be dropped at runtime, and denied by default in a child process.
test/parallel/test-process-env-allowed-flags-are-documented.js
+4 -4
View File
@@ -5,7 +5,7 @@ const common = require('../common');
const assert = require('assert');
const fs = require('fs');
const path = require('path');
const { hasOpenSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
const rootDir = path.resolve(__dirname, '..', '..');
const cliMd = path.join(rootDir, 'doc', 'api', 'cli.md');
@@ -44,7 +44,7 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
}
}
if (!hasOpenSSL(3)) {
if (isBoringSSL) {
documented.delete('--openssl-legacy-provider');
documented.delete('--openssl-shared-config');
}
@@ -63,8 +63,8 @@ const conditionalOpts = [
filter: (opt) => {
return [
'--openssl-config',
hasOpenSSL(3) ? '--openssl-legacy-provider' : '',
hasOpenSSL(3) ? '--openssl-shared-config' : '',
isBoringSSL ? '' : '--openssl-legacy-provider',
isBoringSSL ? '' : '--openssl-shared-config',
'--tls-cipher-list',
'--use-bundled-ca',
'--use-openssl-ca',
test/parallel/test-process-versions.js
+4 -8
View File
@@ -104,18 +104,14 @@ assert.match(
assert.match(process.versions.modules, /^\d+$/);
if (common.hasCrypto) {
const { hasOpenSSL } = require('../common/crypto');
assert.match(process.versions.ncrypto, commonTemplate);
if (process.config.variables.node_shared_openssl) {
assert.ok(process.versions.openssl);
} else {
const versionRegex = hasOpenSSL(3) ?
// The following also matches a development version of OpenSSL 3.x which
// can be in the format '3.0.0-alpha4-dev'. This can be handy when
// building and linking against the main development branch of OpenSSL.
/^\d+\.\d+\.\d+(?:[-+][a-z0-9]+)*$/ :
/^\d+\.\d+\.\d+[a-z]?(\+quic)?(-fips)?$/;
assert.match(process.versions.openssl, versionRegex);
// The following also matches a development version of OpenSSL, such as
// '3.0.0-alpha4-dev'. This can be handy when
// building and linking against the main development branch of OpenSSL.
assert.match(process.versions.openssl, /^\d+\.\d+\.\d+(?:[-+][a-z0-9]+)*$/);
}
}
test/parallel/test-tls-alert-handling.js
-9
View File
@@ -5,11 +5,6 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
const {
hasOpenSSL,
isBoringSSL,
} = require('../common/crypto');
const assert = require('assert');
const net = require('net');
const tls = require('tls');
@@ -39,8 +34,6 @@ const errorHandler = common.mustCall((err) => {
assert.match(err.code,
/ERR_SSL_(WRONG_VERSION_NUMBER|PACKET_LENGTH_TOO_LONG|BAD_RECORD_TYPE)/);
assert.strictEqual(err.library, 'SSL routines');
if (!hasOpenSSL(3) && !isBoringSSL)
assert.strictEqual(err.function, 'ssl3_get_record');
assert.match(err.reason,
/wrong[\s_]version[\s_]number|packet[\s_]length[\s_]too[\s_]long|bad[\s_]record[\s_]type/i);
errorReceived = true;
@@ -100,8 +93,6 @@ function sendBADTLSRecord() {
assert.match(err.code,
/ERR_SSL_(TLSV1_ALERT_PROTOCOL_VERSION|TLSV1_ALERT_RECORD_OVERFLOW|(SSL\/)?TLS_ALERT_UNEXPECTED_MESSAGE)/);
assert.strictEqual(err.library, 'SSL routines');
if (!hasOpenSSL(3) && !isBoringSSL)
assert.strictEqual(err.function, 'ssl3_read_bytes');
assert.match(err.reason,
/tlsv1[\s_]alert[\s_]protocol[\s_]version|tlsv1[\s_]alert[\s_]record[\s_]overflow|(ssl\/)?tls[\s_]alert[\s_]unexpected[\s_]message/i);
}));
test/parallel/test-tls-client-mindhsize.js
+1 -1
View File
@@ -8,7 +8,7 @@ if (!common.hasCrypto)
// are available by default. Different OpenSSL versions have different
// default security levels and we use this value to adjust what a test
// expects based on the security level. You can read more in
// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour
// https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour
const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
const assert = require('assert');
const tls = require('tls');
test/parallel/test-tls-client-renegotiation-13.js
+2 -4
View File
@@ -5,7 +5,7 @@ const common = require('../common');
if (!common.hasCrypto) {
common.skip('missing crypto');
}
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
const fixtures = require('../common/fixtures');
@@ -40,9 +40,7 @@ connect({
});
} else {
assert.throws(() => { throw err; }, {
message: hasOpenSSL(3) ?
'error:0A00010A:SSL routines::wrong ssl version' :
'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
message: 'error:0A00010A:SSL routines::wrong ssl version',
code: 'ERR_SSL_WRONG_SSL_VERSION',
library: 'SSL routines',
reason: 'wrong ssl version',
test/parallel/test-tls-dhe.js
+2 -2
View File
@@ -43,7 +43,7 @@ const {
// are available by default. Different OpenSSL versions have different
// default security levels and we use this value to adjust what a test
// expects based on the security level. You can read more in
// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour
// https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour
const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
if (!opensslCli) {
@@ -67,7 +67,7 @@ const ciphers = `${dheCipher}:${ecdheCipher}`;
if (secLevel < 2 && !hasFIPS(3)) {
// Test will emit a warning because the DH parameter size is < 2048 bits
// when the test is run on versions lower than OpenSSL32
// when the test is run on OpenSSL versions earlier than 3.2
common.expectWarning('SecurityWarning',
'DH parameter is less than 2048 bits');
}
test/parallel/test-tls-junk-closes-server.js
+2 -2
View File
@@ -42,7 +42,7 @@ server.listen(0, common.mustCall(function() {
c.on('data', function() {
// We must consume all data sent by the server. Otherwise the
// end event will not be sent and the test will hang.
// For example, when compiled with OpenSSL32 we see the
// For example, when compiled with OpenSSL 3.2 we see the
// following response '15 03 03 00 02 02 16' which
// decodes as a fatal (0x02) TLS error alert number 22 (0x16),
// which corresponds to TLS1_AD_RECORD_OVERFLOW which matches
@@ -51,7 +51,7 @@ server.listen(0, common.mustCall(function() {
// but the TLS spec seems to indicate there should be one
// https://datatracker.ietf.org/doc/html/rfc8446#page-85
// and error handling seems to have been re-written/improved
// in OpenSSL32. Consuming the data allows the test to pass
// in OpenSSL 3.2. Consuming the data allows the test to pass
// either way.
});
test/parallel/test-tls-key-mismatch.js
+2 -4
View File
@@ -27,15 +27,13 @@ if (!common.hasCrypto) {
}
const fixtures = require('../common/fixtures');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const tls = require('tls');
const errorMessageRegex = isBoringSSL ?
/^Error: error:0b000074:X\.509 certificate routines:OPENSSL_internal:KEY_VALUES_MISMATCH$/ :
hasOpenSSL(3) ?
/^Error: error:05800074:x509 certificate routines::key values mismatch$/ :
/^Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch$/;
/^Error: error:05800074:x509 certificate routines::key values mismatch$/;
const options = {
key: fixtures.readKey('agent1-key.pem'),
test/parallel/test-tls-legacy-pfx.js
+3 -3
View File
@@ -4,10 +4,10 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
const { hasOpenSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3)) {
common.skip('OpenSSL legacy failures are only testable with OpenSSL 3+');
if (isBoringSSL) {
common.skip('OpenSSL legacy failures are not testable with BoringSSL');
}
const fixtures = require('../common/fixtures');
test/parallel/test-tls-min-max-version.js
+5 -9
View File
@@ -43,9 +43,9 @@ function test(cmin, cmax, cprot, smin, smax, sprot, proto, cerr, serr) {
}
let ciphers;
if (hasOpenSSL(3) && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
proto === 'TLSv1_1_method' || proto === 'TLSv1_method' ||
sprot === 'TLSv1_1_method' || sprot === 'TLSv1_method')) {
if (!isBoringSSL && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
proto === 'TLSv1_1_method' || proto === 'TLSv1_method' ||
sprot === 'TLSv1_1_method' || sprot === 'TLSv1_method')) {
if (serr !== 'ERR_SSL_UNSUPPORTED_PROTOCOL')
ciphers = 'ALL@SECLEVEL=0';
}
@@ -179,15 +179,11 @@ for (const [method, version] of [
test(U, U, 'TLS_method', U, U, method, ...expected);
}
// OpenSSL 1.1.1 and 3.0 use a different error code and alert (sent to the
// client) when no protocols are enabled on the server.
// BoringSSL closes the connection without sending an alert in this case.
const NO_PROTOCOLS_AVAILABLE_SERVER = isBoringSSL ?
'ERR_SSL_NO_SUPPORTED_VERSIONS_ENABLED' : hasOpenSSL(3) ?
'ERR_SSL_NO_PROTOCOLS_AVAILABLE' : 'ERR_SSL_INTERNAL_ERROR';
'ERR_SSL_NO_SUPPORTED_VERSIONS_ENABLED' : 'ERR_SSL_NO_PROTOCOLS_AVAILABLE';
const NO_PROTOCOLS_AVAILABLE_SERVER_ALERT = isBoringSSL ?
'ECONNRESET' : hasOpenSSL(3) ?
'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION' : 'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR';
'ECONNRESET' : 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION';
const NO_PROTOCOLS_AVAILABLE_CLIENT = isBoringSSL ?
'ERR_SSL_NO_SUPPORTED_VERSIONS_ENABLED' : 'ERR_SSL_NO_PROTOCOLS_AVAILABLE';
const NO_PROTOCOLS_AVAILABLE_CLIENT_ALERT = isBoringSSL ?
test/parallel/test-tls-set-ciphers.js
+2 -6
View File
@@ -1,7 +1,7 @@
'use strict';
const common = require('../common');
if (!common.hasCrypto) {
common.skip('missing crypto, or OpenSSL version lower than 3');
common.skip('missing crypto');
}
const {
@@ -10,10 +10,6 @@ const {
isBoringSSL,
} = require('../common/crypto');
if (!hasOpenSSL(3) && !isBoringSSL) {
common.skip('missing crypto, or OpenSSL version lower than 3');
}
const fixtures = require('../common/fixtures');
const { inspect } = require('util');
@@ -154,7 +150,7 @@ if (hasFIPS(3)) {
// TLS_AES_128_CCM_8_SHA256 & TLS_AES_128_CCM_SHA256 are not enabled by
// default, but work.
// However, for OpenSSL32 AES_128 is not enabled due to the
// However, for OpenSSL 3.2 AES_128 is not enabled due to the
// default security level
if (isBoringSSL) {
// BoringSSL does not implement the TLS 1.3 CCM cipher suites.
test/parallel/test-tls13-ciphers.js
+4 -10
View File
@@ -7,7 +7,7 @@ const assert = require('assert');
const { constants } = require('crypto');
const tls = require('tls');
const fixtures = require('../common/fixtures');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
const { spawnSyncAndAssert } = require('../common/child_process');
const { connect, keys } = require(fixtures.path('tls-connect'));
@@ -90,16 +90,10 @@ test(aes128, aes256, undefined);
const duplicates = `${aes256} \t:${aes256}`;
test(duplicates, duplicates, aes256);
// OpenSSL 1.1.1 rejects unknown TLS 1.3 cipher names. OpenSSL 3 and BoringSSL
// ignore them and do not interpret exclusion rules in the TLS 1.3 list.
// Unknown TLS 1.3 cipher names are ignored, and exclusion rules are not
// interpreted in the TLS 1.3 list.
const list = `TLS_UNKNOWN:!${aes128}:${duplicates}`;
if (hasOpenSSL(3) || isBoringSSL) {
test(list, list, aes256);
} else {
assert.throws(() => tls.createSecureContext({ ciphers: list }), {
code: 'ERR_SSL_NO_CIPHER_MATCH',
});
}
test(list, list, aes256);
for (const ciphers of ['TLS_UNKNOWN', `!${aes128}`]) {
assert.throws(() => tls.createSecureContext({ ciphers }), {
code: 'ERR_SSL_NO_CIPHER_MATCH',
test/parallel/test-trace-env.js
+2 -2
View File
@@ -19,8 +19,8 @@ spawnSyncAndAssert(process.execPath, ['--trace-env', fixtures.path('empty.js')],
if (common.hasCrypto) {
assert.match(output, /get "NODE_EXTRA_CA_CERTS"/);
const { hasOpenSSL } = require('../common/crypto');
if (hasOpenSSL(3)) {
const { isBoringSSL } = require('../common/crypto');
if (!isBoringSSL) {
assert.match(output, /get "OPENSSL_CONF"/);
}
}
test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js
+2 -2
View File
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('assert');
const { hasOpenSSL, hasFIPS } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
const { subtle } = globalThis.crypto;
const fips3 = hasFIPS(3);
@@ -56,7 +56,7 @@ if (fips3) {
tests.push(test('ChaCha20-Poly1305', 32, 12, 'raw-secret'));
}
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
tests.push(test(
'AES-OCB',
32,
test/parallel/test-webcrypto-deduplicate-usages.js
+8 -8
View File
@@ -54,7 +54,7 @@ function assertSameSet(actual, expected, msg) {
symmetric.splice(symmetric.findIndex(({ algorithm }) =>
algorithm.name === 'ChaCha20-Poly1305'), 1);
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
symmetric.push({
algorithm: { name: 'AES-OCB', length: 128 },
usages: ['decrypt', 'encrypt', 'decrypt', 'encrypt'],
@@ -66,7 +66,7 @@ function assertSameSet(actual, expected, msg) {
expected: ['sign', 'verify'],
});
} else {
common.printSkipMessage('AES-OCB and KMAC require OpenSSL >= 3');
common.printSkipMessage('AES-OCB and KMAC are not supported by BoringSSL');
}
for (const { algorithm, usages, expected } of symmetric) {
@@ -178,7 +178,7 @@ function assertSameSet(actual, expected, msg) {
expected: ['wrapKey', 'unwrapKey'] },
];
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
// KMAC does not support `raw` format, only `raw-secret` and `jwk`.
tests.push((async () => {
const key = await subtle.importKey(
@@ -203,7 +203,7 @@ function assertSameSet(actual, expected, msg) {
assert.strictEqual(key.usages.length, 2);
})());
} else {
common.printSkipMessage('AES-OCB and KMAC require OpenSSL >= 3');
common.printSkipMessage('AES-OCB and KMAC are not supported by BoringSSL');
}
for (const { algorithm, keyData, usages, expected } of rawSymmetric) {
@@ -374,7 +374,7 @@ function assertSameSet(actual, expected, msg) {
})());
// AES-OCB raw-secret import.
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
tests.push((async () => {
const imported = subtle.importKey(
'raw-secret',
@@ -393,7 +393,7 @@ function assertSameSet(actual, expected, msg) {
assert.strictEqual(key.usages.length, 2);
})());
} else {
common.printSkipMessage('AES-OCB requires OpenSSL >= 3');
common.printSkipMessage('AES-OCB is not supported by BoringSSL');
}
Promise.all(tests).then(common.mustCall());
@@ -469,7 +469,7 @@ function assertSameSet(actual, expected, msg) {
expected: ['wrapKey', 'unwrapKey'] },
];
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
jwkVectors.push({
algorithm: { name: 'AES-OCB', length: 128 },
usages: ['decrypt', 'encrypt', 'decrypt', 'encrypt'],
@@ -481,7 +481,7 @@ function assertSameSet(actual, expected, msg) {
expected: ['sign', 'verify'],
});
} else {
common.printSkipMessage('AES-OCB and KMAC require OpenSSL >= 3');
common.printSkipMessage('AES-OCB and KMAC are not supported by BoringSSL');
}
for (const { algorithm, usages, expected } of jwkVectors) {
test/parallel/test-webcrypto-derivebits-hkdf.js
+3 -3
View File
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('assert');
const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
const { subtle } = globalThis.crypto;
function getDeriveKeyInfo(name, length, hash, ...usages) {
@@ -38,13 +38,13 @@ if (!isBoringSSL) {
common.printSkipMessage('SHA-3 is only supported for digest operations');
}
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
kDerivedKeyTypes.push(
['AES-OCB', 128, undefined, 'encrypt', 'decrypt'],
['AES-OCB', 256, undefined, 'encrypt', 'decrypt'],
);
} else {
common.printSkipMessage('Skipping unsupported test cases');
common.printSkipMessage('Skipping AES-OCB test cases unsupported by BoringSSL');
}
const kDerivedKeys = {
test/parallel/test-webcrypto-derivekey.js
+4 -4
View File
@@ -6,7 +6,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const { subtle } = globalThis.crypto;
@@ -191,7 +191,7 @@ const fips4 = hasFIPS(4);
common.printSkipMessage('SHA-3 is only supported for digest operations');
}
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
vectors.push(
['KMAC128', 'sign', 128],
[{ name: 'KMAC128', length: 384 }, 'sign', 384],
@@ -251,7 +251,7 @@ const fips4 = hasFIPS(4);
common.printSkipMessage('SHA-3 is only supported for digest operations');
}
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
vectors.push(
['KMAC128', 'sign', 128],
[{ name: 'KMAC128', length: 384 }, 'sign', 384],
@@ -284,7 +284,7 @@ const fips4 = hasFIPS(4);
})().then(common.mustCall());
}
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
(async () => {
const derivedKeyAlgorithm = { name: 'KMAC128', length: 0 };
const usages = ['sign'];
test/parallel/test-webcrypto-encrypt-decrypt-aes.js
+2 -2
View File
@@ -5,7 +5,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasOpenSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const { getFips } = require('crypto');
@@ -230,7 +230,7 @@ async function testDecrypt({ keyBuffer, algorithm, result }) {
}
// Test aes-ocb vectors
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
const {
passing,
failing,
test/parallel/test-webcrypto-encrypt-decrypt.js
+3 -3
View File
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('assert');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
const { getFips } = require('crypto');
const { subtle } = globalThis.crypto;
@@ -148,7 +148,7 @@ async function testRSAOaep(publicKey, privateKey) {
}
// Test Encrypt/Decrypt AES-OCB
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
const buf = globalThis.crypto.getRandomValues(new Uint8Array(50));
const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
@@ -180,5 +180,5 @@ if (hasOpenSSL(3)) {
test().then(common.mustCall());
}
} else {
common.printSkipMessage('Skipping unsupported AES-OCB test cases');
common.printSkipMessage('Skipping AES-OCB test cases unsupported by BoringSSL');
}
test/parallel/test-webcrypto-export-import.js
+2 -2
View File
@@ -6,7 +6,7 @@ const fixtures = require('../common/fixtures');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const { subtle } = globalThis.crypto;
@@ -221,7 +221,7 @@ const {
}
// Import/Export KMAC Secret Key
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
async function test(name) {
const keyData = globalThis.crypto.getRandomValues(new Uint8Array(32));
const key = await subtle.importKey(
test/parallel/test-webcrypto-keygen-kmac.js
+3 -3
View File
@@ -5,10 +5,10 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasOpenSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3))
common.skip('requires OpenSSL >= 3');
if (isBoringSSL)
common.skip('KMAC is not supported by BoringSSL');
const assert = require('assert');
const { types: { isCryptoKey } } = require('util');
test/parallel/test-webcrypto-keygen.js
+1 -1
View File
@@ -177,7 +177,7 @@ if (!isBoringSSL) {
common.printSkipMessage('Skipping unsupported test cases');
}
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
vectors['AES-OCB'] = {
algorithm: { length: 256 },
result: 'CryptoKey',
test/parallel/test-webcrypto-kmac-empty-output.js
+3 -3
View File
@@ -5,10 +5,10 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasFIPS, hasOpenSSL } = require('../common/crypto');
const { hasFIPS, isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3))
common.skip('requires OpenSSL >= 3');
if (isBoringSSL)
common.skip('KMAC is not supported by BoringSSL');
if (hasFIPS())
common.skip('empty KMAC output is not supported in FIPS mode');
test/parallel/test-webcrypto-sign-verify-kmac.js
+3 -3
View File
@@ -5,10 +5,10 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const { hasOpenSSL } = require('../common/crypto');
const { isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3))
common.skip('requires OpenSSL >= 3');
if (isBoringSSL)
common.skip('KMAC is not supported by BoringSSL');
const assert = require('assert');
const { subtle } = globalThis.crypto;
test/parallel/test-webcrypto-sign-verify.js
+1 -1
View File
@@ -109,7 +109,7 @@ const { subtle } = globalThis.crypto;
}
// Test Sign/Verify KMAC
if (hasOpenSSL(3)) {
if (!isBoringSSL) {
async function test(name, data) {
const ec = new TextEncoder();
test/parallel/test-webcrypto-supports-fips.js
+2 -2
View File
@@ -3,8 +3,8 @@
const common = require('../common');
if (!common.hasCrypto) common.skip('missing crypto');
const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
if (!hasOpenSSL(3) || isBoringSSL) common.skip('requires OpenSSL 3');
const { isBoringSSL } = require('../common/crypto');
if (isBoringSSL) common.skip('requires an OpenSSL provider');
const assert = require('node:assert');
const crypto = require('node:crypto');
test/parallel/test-webcrypto-wrap-unwrap.js
+2 -2
View File
@@ -60,7 +60,7 @@ const kWrappingData = {
if (fips3)
delete kWrappingData['ChaCha20-Poly1305'];
if (hasOpenSSL(3) && !fips3) {
if (!isBoringSSL && !fips3) {
kWrappingData['AES-OCB'] = {
generate: { length: 128 },
wrap: {
@@ -484,7 +484,7 @@ async function testNonByteLengthWrapUnwrap({
implicitAlgorithm: hmacAlgorithm,
});
if (hasOpenSSL(3) && getFips() !== 1) {
if (!isBoringSSL && getFips() !== 1) {
for (const name of ['KMAC128', 'KMAC256']) {
const keyData = new Uint8Array(32).fill(0xff);
const kmacKey = await subtle.importKey(
Loaded 100 of 104 files, more files were not shown because too many files have changed in this diff. Show more