From acbc3ff133318aa2e19a57da6e8a4ae32aeec4e0 Mon Sep 17 00:00:00 2001 From: Filip Skokan Date: Sun, 26 Jul 2026 14:18:38 +0200 Subject: [PATCH] test,benchmark: drop OpenSSL 1.x-only coverage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Delete test-crypto-ecb.js, which can no longer run anywhere: Blowfish is available only from OpenSSL's legacy provider and is absent from BoringSSL. The addon and cctest version guards become OPENSSL_IS_BORINGSSL checks. Remove legacy digest-alias coverage and unreachable OpenSSL 1.x branches. JavaScript test and benchmark gates, skip reasons, and TLS error expectations that distinguished OpenSSL 1.x from provider-backed OpenSSL now distinguish BoringSSL, including PKCS12 parsing, named DH groups, private-key serialization, RSA-PSS parameters, consolidated provider caches, FIPS availability, and empty KMAC output. Keep the CCM alternate finalization error only for BoringSSL. Provider-only test skips use version-neutral terminology or state the actual minimum OpenSSL version. Signed-off-by: Filip Skokan Assisted-by: Codex PR-URL: https://github.com/nodejs/node/pull/64777 Fixes: https://github.com/nodejs/node/issues/56733 Refs: https://github.com/nodejs/node/pull/64211 Refs: https://github.com/nodejs/node/pull/63966 Refs: https://github.com/nodejs/node/pull/53329 Refs: https://github.com/nodejs/node/pull/48950 Refs: https://github.com/nodejs/node/issues/45465 Refs: https://github.com/nodejs/node/issues/42827 Refs: https://github.com/nodejs/node/issues/47076 Refs: https://github.com/nodejs/node/pull/62862 Refs: https://github.com/nodejs/node/pull/38512 Reviewed-By: Yagiz Nizipli Reviewed-By: James M Snell Reviewed-By: Richard Lau Reviewed-By: Gürgün Dayıoğlu --- benchmark/crypto/kem.js | 4 +- benchmark/crypto/mac.js | 7 +-- test/addons/openssl-providers/binding.cc | 9 +-- test/addons/openssl-providers/providers.cjs | 6 +- test/cctest/test_node_crypto_env.cc | 2 +- test/common/crypto.js | 3 - .../webcrypto/supports-modern-algorithms.mjs | 4 +- test/parallel/test-cli-node-options.js | 4 +- test/parallel/test-config-json-schema.js | 6 +- .../parallel/test-crypto-async-sign-verify.js | 14 ++--- test/parallel/test-crypto-authenticated.js | 2 +- .../test-crypto-cipheriv-decipheriv.js | 6 +- test/parallel/test-crypto-classes.js | 4 +- test/parallel/test-crypto-dh-curves.js | 11 +--- test/parallel/test-crypto-dh-errors.js | 4 +- test/parallel/test-crypto-dh-odd-key.js | 4 +- test/parallel/test-crypto-dh-stateless.js | 31 +++------ test/parallel/test-crypto-dh.js | 5 +- test/parallel/test-crypto-ecb.js | 63 ------------------- test/parallel/test-crypto-encap-decap.js | 7 +-- .../test-crypto-fips-indicator-strict.js | 2 +- test/parallel/test-crypto-getcipherinfo.js | 4 +- test/parallel/test-crypto-hkdf.js | 7 +-- test/parallel/test-crypto-hmac.js | 13 ---- test/parallel/test-crypto-job-error-parity.js | 4 +- test/parallel/test-crypto-kem-shared-key.js | 5 +- ...est-crypto-key-encoding-provider-cipher.js | 4 +- test/parallel/test-crypto-key-objects.js | 34 ++++------ test/parallel/test-crypto-key-store-pkcs11.js | 6 +- test/parallel/test-crypto-key-store.js | 6 +- ...test-crypto-keygen-async-dsa-key-object.js | 8 +-- test/parallel/test-crypto-keygen-async-dsa.js | 8 +-- ...-explicit-elliptic-curve-encrypted-p256.js | 8 +-- ...nc-explicit-elliptic-curve-encrypted.js.js | 7 +-- ...ync-named-elliptic-curve-encrypted-p256.js | 10 +-- ...en-async-named-elliptic-curve-encrypted.js | 10 +-- test/parallel/test-crypto-keygen-async-rsa.js | 12 ++-- .../parallel/test-crypto-keygen-bit-length.js | 28 ++++----- ...rypto-keygen-empty-passphrase-no-prompt.js | 12 ++-- .../test-crypto-keygen-missing-oid.js | 46 +++++++------- test/parallel/test-crypto-keygen.js | 13 +--- test/parallel/test-crypto-mac-errors.js | 6 +- test/parallel/test-crypto-mac-unsupported.js | 4 +- test/parallel/test-crypto-mac-vectors.js | 6 +- test/parallel/test-crypto-mac.js | 6 +- test/parallel/test-crypto-negative-zero.js | 6 +- test/parallel/test-crypto-no-algorithm.js | 6 +- test/parallel/test-crypto-padding.js | 12 ++-- test/parallel/test-crypto-pbkdf2.js | 4 +- test/parallel/test-crypto-pkcs12.js | 4 +- .../test-crypto-pqc-key-objects-ml-dsa.js | 4 +- .../test-crypto-pqc-key-objects-ml-kem.js | 4 +- .../test-crypto-pqc-key-objects-slh-dsa.js | 6 +- test/parallel/test-crypto-prime.js | 5 +- .../test-crypto-private-decrypt-gh32240.js | 8 +-- .../test-crypto-provider-cache-snapshot.js | 6 +- test/parallel/test-crypto-provider-cache.js | 6 +- .../test-crypto-provider-hash-options.js | 2 +- test/parallel/test-crypto-provider-hashes.js | 6 +- ...t-crypto-publicDecrypt-fails-first-time.js | 6 +- test/parallel/test-crypto-rsa-dsa.js | 58 +++++------------ .../test-crypto-rsa-multiprime-jwk.js | 4 +- .../test-crypto-rsa-pss-parameters.js | 6 +- test/parallel/test-crypto-sec-level.js | 2 +- test/parallel/test-crypto-secure-heap.js | 5 +- test/parallel/test-crypto-sign-verify.js | 21 ++----- test/parallel/test-crypto-stream.js | 8 +-- test/parallel/test-crypto-x509.js | 17 +---- test/parallel/test-crypto.js | 45 +++---------- ...agnostics-channel-crypto-fips-indicator.js | 2 +- .../test-https-agent-session-eviction.js | 2 +- ...ttps-selfsigned-no-keycertsign-no-crash.js | 15 +---- .../parallel/test-permission-openssl-store.js | 6 +- ...rocess-env-allowed-flags-are-documented.js | 8 +-- test/parallel/test-process-versions.js | 12 ++-- test/parallel/test-tls-alert-handling.js | 9 --- test/parallel/test-tls-client-mindhsize.js | 2 +- .../test-tls-client-renegotiation-13.js | 6 +- test/parallel/test-tls-dhe.js | 4 +- test/parallel/test-tls-junk-closes-server.js | 4 +- test/parallel/test-tls-key-mismatch.js | 6 +- test/parallel/test-tls-legacy-pfx.js | 6 +- test/parallel/test-tls-min-max-version.js | 14 ++--- test/parallel/test-tls-set-ciphers.js | 8 +-- test/parallel/test-tls13-ciphers.js | 14 ++--- test/parallel/test-trace-env.js | 4 +- ...-webcrypto-aead-decrypt-detached-buffer.js | 4 +- .../test-webcrypto-deduplicate-usages.js | 16 ++--- .../test-webcrypto-derivebits-hkdf.js | 6 +- test/parallel/test-webcrypto-derivekey.js | 8 +-- .../test-webcrypto-encrypt-decrypt-aes.js | 4 +- .../test-webcrypto-encrypt-decrypt.js | 6 +- test/parallel/test-webcrypto-export-import.js | 4 +- test/parallel/test-webcrypto-keygen-kmac.js | 6 +- test/parallel/test-webcrypto-keygen.js | 2 +- .../test-webcrypto-kmac-empty-output.js | 6 +- .../test-webcrypto-sign-verify-kmac.js | 6 +- test/parallel/test-webcrypto-sign-verify.js | 2 +- test/parallel/test-webcrypto-supports-fips.js | 4 +- test/parallel/test-webcrypto-wrap-unwrap.js | 4 +- test/parallel/test-x509-escaping.js | 20 +++--- test/pummel/test-crypto-dh-hash.js | 6 +- test/pummel/test-dh-regr.js | 8 +-- test/wpt/status/WebCryptoAPI.cjs | 2 +- 104 files changed, 338 insertions(+), 614 deletions(-) delete mode 100644 test/parallel/test-crypto-ecb.js diff --git a/benchmark/crypto/kem.js b/benchmark/crypto/kem.js index 34374dfc849..05e640e1f5b 100644 --- a/benchmark/crypto/kem.js +++ b/benchmark/crypto/kem.js @@ -35,12 +35,12 @@ if (hasOpenSSL(3, 2)) { keyFixtures.x25519 = readKeyPair('x25519_public', 'x25519_private'); keyFixtures.x448 = readKeyPair('x448_public', 'x448_private'); } -if (hasOpenSSL(3, 0)) { +if (!isBoringSSL) { keyFixtures.rsa = readKeyPair('rsa_public_2048', 'rsa_private_2048'); } if (Object.keys(keyFixtures).length === 0) { - console.log('no supported key types available for this OpenSSL version'); + console.log('no supported key types available for this crypto implementation'); process.exit(0); } diff --git a/benchmark/crypto/mac.js b/benchmark/crypto/mac.js index ea9d3a56e59..a6ff89f22ea 100644 --- a/benchmark/crypto/mac.js +++ b/benchmark/crypto/mac.js @@ -1,7 +1,7 @@ 'use strict'; const common = require('../common.js'); -const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js'); +const { isBoringSSL } = require('../../test/common/crypto.js'); const assert = require('node:assert'); const { createHmac, @@ -9,11 +9,10 @@ const { getMacs, } = require('node:crypto'); -if (!hasOpenSSL(3) || - isBoringSSL || +if (isBoringSSL || typeof createMac !== 'function' || typeof getMacs !== 'function') { - console.log('Skipping: generic MAC API requires OpenSSL >= 3'); + console.log('Skipping: generic MAC API requires OpenSSL EVP_MAC support'); process.exit(0); } diff --git a/test/addons/openssl-providers/binding.cc b/test/addons/openssl-providers/binding.cc index 785a103bb6c..36f8de59ccd 100644 --- a/test/addons/openssl-providers/binding.cc +++ b/test/addons/openssl-providers/binding.cc @@ -1,8 +1,9 @@ #include #include -#include -#if OPENSSL_VERSION_MAJOR >= 3 +// BoringSSL declares OPENSSL_IS_BORINGSSL in crypto.h. +#include +#ifndef OPENSSL_IS_BORINGSSL #include #endif @@ -18,7 +19,7 @@ using v8::Object; using v8::String; using v8::Value; -#if OPENSSL_VERSION_MAJOR >= 3 +#ifndef OPENSSL_IS_BORINGSSL int collectProviders(OSSL_PROVIDER* provider, void* cbdata) { static_cast*>(cbdata)->push_back(provider); return 1; @@ -28,7 +29,7 @@ int collectProviders(OSSL_PROVIDER* provider, void* cbdata) { inline void GetProviders(const FunctionCallbackInfo& args) { Isolate* isolate = args.GetIsolate(); LocalVector arr(isolate, 0); -#if OPENSSL_VERSION_MAJOR >= 3 +#ifndef OPENSSL_IS_BORINGSSL std::vector providers; OSSL_PROVIDER_do_all(nullptr, &collectProviders, &providers); for (auto provider : providers) { diff --git a/test/addons/openssl-providers/providers.cjs b/test/addons/openssl-providers/providers.cjs index 7e7a958b900..08cab0d4687 100644 --- a/test/addons/openssl-providers/providers.cjs +++ b/test/addons/openssl-providers/providers.cjs @@ -4,10 +4,10 @@ const common = require('../../common'); if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL } = require('../../common/crypto'); +const { isBoringSSL } = require('../../common/crypto'); -if (!hasOpenSSL(3)) { - common.skip('this test requires OpenSSL 3.x'); +if (isBoringSSL) { + common.skip('OpenSSL provider support is required'); } const assert = require('node:assert'); const { diff --git a/test/cctest/test_node_crypto_env.cc b/test/cctest/test_node_crypto_env.cc index 1d31dc98329..4c349ac1a0a 100644 --- a/test/cctest/test_node_crypto_env.cc +++ b/test/cctest/test_node_crypto_env.cc @@ -26,7 +26,7 @@ TEST_F(NodeCryptoEnv, LoadBIO) { // just put a random string into BIO Local key = String::NewFromUtf8(isolate_, "abcdef").ToLocalChecked(); ncrypto::BIOPointer bio(node::crypto::LoadBIO(*env, key)); -#if OPENSSL_VERSION_NUMBER >= 0x30000000L +#ifndef OPENSSL_IS_BORINGSSL const int ofs = 2; ASSERT_EQ(BIO_seek(bio.get(), ofs), ofs); ASSERT_EQ(BIO_tell(bio.get()), ofs); diff --git a/test/common/crypto.js b/test/common/crypto.js index 49678e0de43..80a22c89aa1 100644 --- a/test/common/crypto.js +++ b/test/common/crypto.js @@ -147,9 +147,6 @@ module.exports = { hasOpenSSL, hasFIPS, isBoringSSL, - get hasOpenSSL3() { - return hasOpenSSL(3); - }, // opensslCli defined lazily to reduce overhead of spawnSync get opensslCli() { if (opensslCli !== null) return opensslCli; diff --git a/test/fixtures/webcrypto/supports-modern-algorithms.mjs b/test/fixtures/webcrypto/supports-modern-algorithms.mjs index 250646125fa..885725e99f0 100644 --- a/test/fixtures/webcrypto/supports-modern-algorithms.mjs +++ b/test/fixtures/webcrypto/supports-modern-algorithms.mjs @@ -13,8 +13,8 @@ const shake128 = crypto.getHashes().includes('shake128'); const shake256 = crypto.getHashes().includes('shake256'); const cshake128 = crypto.getHashes().includes('cshake128'); const cshake256 = crypto.getHashes().includes('cshake256'); -const ocb = hasOpenSSL(3) && crypto.getCiphers().includes('aes-128-ocb'); -const kmac = hasOpenSSL(3) && crypto.getMacs().includes('kmac128'); +const ocb = !isBoringSSL && crypto.getCiphers().includes('aes-128-ocb'); +const kmac = !isBoringSSL && crypto.getMacs().includes('kmac128'); const hybridKems = !fips && pqc && (!boringSSL || shake256); diff --git a/test/parallel/test-cli-node-options.js b/test/parallel/test-cli-node-options.js index 375c46c11ab..fa290d23c96 100644 --- a/test/parallel/test-cli-node-options.js +++ b/test/parallel/test-cli-node-options.js @@ -12,7 +12,7 @@ const { Worker } = require('worker_threads'); const fixtures = require('../common/fixtures'); const tmpdir = require('../common/tmpdir'); -const { hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); tmpdir.refresh(); const printA = path.relative(tmpdir.path, fixtures.path('printA.js')); @@ -65,7 +65,7 @@ if (common.isLinux) { if (common.hasCrypto) { expectNoWorker('--use-openssl-ca', 'B\n'); expectNoWorker('--use-bundled-ca', 'B\n'); - if (!hasOpenSSL(3)) + if (isBoringSSL) expectNoWorker('--openssl-config=_ossl_cfg', 'B\n'); if (common.isMacOS) { expect('--use-system-ca', 'B\n'); diff --git a/test/parallel/test-config-json-schema.js b/test/parallel/test-config-json-schema.js index 0d9cdb84555..05efa69e2b6 100644 --- a/test/parallel/test-config-json-schema.js +++ b/test/parallel/test-config-json-schema.js @@ -10,10 +10,10 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3)) { - common.skip('this test requires OpenSSL 3.x'); +if (isBoringSSL) { + common.skip('this test is not supported with BoringSSL'); } if (!common.hasIntl) { diff --git a/test/parallel/test-crypto-async-sign-verify.js b/test/parallel/test-crypto-async-sign-verify.js index a60dc73d67b..f4c754d118f 100644 --- a/test/parallel/test-crypto-async-sign-verify.js +++ b/test/parallel/test-crypto-async-sign-verify.js @@ -3,7 +3,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const util = require('util'); const crypto = require('crypto'); @@ -132,7 +132,7 @@ if (!isBoringSSL) { common.printSkipMessage('Skipping unsupported ed448/secp256k1/dsa test cases'); } -// Test Parallel Execution w/ KeyObject is threadsafe in openssl3 +// Test Parallel Execution w/ KeyObject is threadsafe in OpenSSL { const publicKey = { key: crypto.createPublicKey( @@ -171,12 +171,10 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc= const data = crypto.randomBytes(32); const signature = crypto.randomBytes(16); - let expected = /no default digest/; - let expectedCode = 'ERR_OSSL_EVP_NO_DEFAULT_DIGEST'; - if (hasOpenSSL(3) || isBoringSSL) { - expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i; - expectedCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE'; - } + const expected = + /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i; + const expectedCode = + 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE'; crypto.verify(undefined, data, untrustedKey, signature, common.mustCall((err) => { assert.ok(err); diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js index f321bb0105f..a6565aba077 100644 --- a/test/parallel/test-crypto-authenticated.js +++ b/test/parallel/test-crypto-authenticated.js @@ -819,7 +819,7 @@ for (const test of TEST_CASES) { } catch (err) { // OpenSSL without https://github.com/openssl/openssl/pull/32427 // cannot finalize an empty CCM message unless update() was called. - if (hasOpenSSL(3)) { + if (!isBoringSSL) { assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET'); } else { assert.match(err.message, /Unsupported state/); diff --git a/test/parallel/test-crypto-cipheriv-decipheriv.js b/test/parallel/test-crypto-cipheriv-decipheriv.js index d2c216924ea..ab429ecb1d3 100644 --- a/test/parallel/test-crypto-cipheriv-decipheriv.js +++ b/test/parallel/test-crypto-cipheriv-decipheriv.js @@ -5,7 +5,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const isFipsEnabled = crypto.getFips() === 1; const fips3 = hasFIPS(3); @@ -293,8 +293,8 @@ assert.throws( errMessage); // But all other IV lengths should be accepted. -const minIvLength = hasOpenSSL(3) ? 8 : 1; -const maxIvLength = hasOpenSSL(3) ? 64 : 256; +const minIvLength = isBoringSSL ? 1 : 8; +const maxIvLength = isBoringSSL ? 256 : 64; for (let n = minIvLength; n < maxIvLength; n += 1) { if (isFipsEnabled && n < 12) continue; crypto.createCipheriv('aes-128-gcm', Buffer.alloc(16), Buffer.alloc(n)); diff --git a/test/parallel/test-crypto-classes.js b/test/parallel/test-crypto-classes.js index 48d68c93fb6..e875f706110 100644 --- a/test/parallel/test-crypto-classes.js +++ b/test/parallel/test-crypto-classes.js @@ -6,7 +6,7 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } const crypto = require('crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); // 'ClassName' : ['args', 'for', 'constructor'] const TEST_CASES = { @@ -31,7 +31,7 @@ if (hasFIPS(3)) { TEST_CASES.DiffieHellman = [2048]; TEST_CASES.DiffieHellmanGroup = ['modp14']; } else if (crypto.getFips() !== 1) { - TEST_CASES.DiffieHellman = [hasOpenSSL(3) ? 1024 : 256]; + TEST_CASES.DiffieHellman = [isBoringSSL ? 256 : 1024]; } for (const [clazz, args] of Object.entries(TEST_CASES)) { diff --git a/test/parallel/test-crypto-dh-curves.js b/test/parallel/test-crypto-dh-curves.js index ef5d0323d33..0b2270b37a3 100644 --- a/test/parallel/test-crypto-dh-curves.js +++ b/test/parallel/test-crypto-dh-curves.js @@ -5,7 +5,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const { DH_CHECK_P_NOT_PRIME, DH_CHECK_P_NOT_SAFE_PRIME, @@ -70,7 +70,7 @@ const bad_dh = isBoringSSL ? crypto.createDiffieHellman('02', 'hex'); assert.notStrictEqual(bad_dh.verifyError, 0); -if (hasOpenSSL(3)) { +if (!isBoringSSL) { const smallSafePrime = crypto.createDiffieHellman( Buffer.from([23]), Buffer.from([2])); assert.notStrictEqual(smallSafePrime.verifyError, 0); @@ -79,11 +79,6 @@ if (hasOpenSSL(3)) { () => crypto.createDiffieHellman(Buffer.from(p, 'hex'), Buffer.from(p, 'hex')), { code: 'ERR_OSSL_DH_BAD_GENERATOR' }); -} else if (!isBoringSSL) { - assert.strictEqual( - crypto.createDiffieHellman(Buffer.from(p, 'hex'), - Buffer.from(p, 'hex')).verifyError, - DH_NOT_SUITABLE_GENERATOR); } const availableCurves = new Set(crypto.getCurves()); @@ -279,7 +274,7 @@ if (availableCurves.has('prime256v1') && availableHashes.has('sha256')) { crypto.createSign('SHA256').sign(ecPrivateKey); } -if (hasFIPS(3) && availableCurves.has('secp256k1')) { +if (hasFIPS() && availableCurves.has('secp256k1')) { const originalFips = crypto.getFips(); try { diff --git a/test/parallel/test-crypto-dh-errors.js b/test/parallel/test-crypto-dh-errors.js index d9f7065655c..d697a72a09f 100644 --- a/test/parallel/test-crypto-dh-errors.js +++ b/test/parallel/test-crypto-dh-errors.js @@ -5,7 +5,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); // https://github.com/nodejs/node/issues/32738 // XXX(bnoordhuis) validateInt32() throwing ERR_OUT_OF_RANGE and RangeError @@ -25,7 +25,7 @@ assert.throws(() => crypto.createDiffieHellman('abcdef', 13.37), { }); for (const bits of [-1, 0, 1]) { - if (hasOpenSSL(3)) { + if (!isBoringSSL) { assert.throws(() => crypto.createDiffieHellman(bits), { code: 'ERR_OSSL_DH_MODULUS_TOO_SMALL', name: 'Error', diff --git a/test/parallel/test-crypto-dh-odd-key.js b/test/parallel/test-crypto-dh-odd-key.js index c96227770e3..32d83fe0d4f 100644 --- a/test/parallel/test-crypto-dh-odd-key.js +++ b/test/parallel/test-crypto-dh-odd-key.js @@ -27,12 +27,12 @@ if (!common.hasCrypto) { const assert = require('assert'); const crypto = require('crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); function test() { const odd = Buffer.alloc(39, 'A'); - const size = hasFIPS(3) ? 2048 : (hasOpenSSL(3) ? 1024 : 32); + const size = hasFIPS(3) ? 2048 : (isBoringSSL ? 32 : 1024); const c = crypto.createDiffieHellman(size); c.setPrivateKey(odd); c.generateKeys(); diff --git a/test/parallel/test-crypto-dh-stateless.js b/test/parallel/test-crypto-dh-stateless.js index 9c0270304f2..d1e134aa4a1 100644 --- a/test/parallel/test-crypto-dh-stateless.js +++ b/test/parallel/test-crypto-dh-stateless.js @@ -20,7 +20,7 @@ let keyTypeMismatchCode; if (hasOpenSSL(4, 0)) { keyTypeMismatchCode = /^ERR_OSSL_EVP_(OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE|INTERNAL_ERROR)$/; -} else if (hasOpenSSL(3)) { +} else if (!isBoringSSL) { keyTypeMismatchCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE'; } else { keyTypeMismatchCode = 'ERR_OSSL_EVP_DIFFERENT_KEY_TYPES'; @@ -341,15 +341,6 @@ if (isBoringSSL) { // Same generator, but different primes. [{ group: 'modp5' }, { group: 'modp18' }]]; - // TODO(danbev): Take a closer look if there should be a check in OpenSSL3 - // when the dh parameters differ. - if (!hasOpenSSL(3)) { - // Same primes, but different generator. - list.push([{ group: 'modp5' }, { prime: group.getPrime(), generator: 5 }]); - // Same generator, but different primes. - list.push([{ primeLength: 1024 }, { primeLength: 1024 }]); - } - for (const [params1, params2] of list) { const options = { privateKey: crypto.generateKeyPairSync('dh', params1).privateKey, @@ -357,9 +348,7 @@ if (isBoringSSL) { }; testDHError(options, { name: 'Error', - code: hasOpenSSL(3) ? - 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' : - 'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' + code: 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' }); } } @@ -420,9 +409,9 @@ test(crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' }), }; testDHError(options, { name: 'Error', - code: hasOpenSSL(3) ? - 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' : - 'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' + code: isBoringSSL ? + 'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' : + 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' }); } @@ -576,9 +565,9 @@ for (const { privateKey: alicePriv, publicKey: bobPub } of [ testDHError({ privateKey: privKey(ec256.privateKey), publicKey: pubKey(ec384.publicKey), - }, { code: hasOpenSSL(3) ? - 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' : - 'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' }); + }, { code: isBoringSSL ? + 'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' : + 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' }); // Incompatible key types (ec + x25519) testDHError({ @@ -607,8 +596,6 @@ for (const { privateKey: alicePriv, publicKey: bobPub } of [ privateKey: privKey(x25519.privateKey), publicKey: pubKey(zeroX25519PublicKey), }, isBoringSSL ? { code: 'ERR_OSSL_EVP_INVALID_PEER_KEY' } : - hasOpenSSL(3) ? - { code: 'ERR_OSSL_FAILED_DURING_DERIVATION' } : - { message: /Deriving bits failed/ }); + { code: 'ERR_OSSL_FAILED_DURING_DERIVATION' }); } } diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js index 7b9a9d50d89..5ef9450b86a 100644 --- a/test/parallel/test-crypto-dh.js +++ b/test/parallel/test-crypto-dh.js @@ -7,14 +7,13 @@ if (!common.hasCrypto) { const assert = require('assert'); const crypto = require('crypto'); const { - hasOpenSSL, hasFIPS, isBoringSSL, } = require('../common/crypto'); { const size = hasFIPS(3) ? - 2048 : (crypto.getFips() === 1 || hasOpenSSL(3) ? 1024 : 256); + 2048 : (crypto.getFips() === 1 || !isBoringSSL ? 1024 : 256); const dh1 = crypto.createDiffieHellman(size); const p1 = dh1.getPrime('buffer'); const dh2 = crypto.createDiffieHellman(p1, 'buffer'); @@ -60,7 +59,7 @@ const { assert.strictEqual(secret1, secret4); let wrongBlockLength; - if (hasOpenSSL(3)) { + if (!isBoringSSL) { wrongBlockLength = { message: /wrong[\s_]final[\s_]block[\s_]length/i, code: /ERR_OSSL_(EVP_)?WRONG_FINAL_BLOCK_LENGTH/, diff --git a/test/parallel/test-crypto-ecb.js b/test/parallel/test-crypto-ecb.js deleted file mode 100644 index 65c373d35d2..00000000000 --- a/test/parallel/test-crypto-ecb.js +++ /dev/null @@ -1,63 +0,0 @@ -// Copyright Joyent, Inc. and other Node contributors. -// -// Permission is hereby granted, free of charge, to any person obtaining a -// copy of this software and associated documentation files (the -// "Software"), to deal in the Software without restriction, including -// without limitation the rights to use, copy, modify, merge, publish, -// distribute, sublicense, and/or sell copies of the Software, and to permit -// persons to whom the Software is furnished to do so, subject to the -// following conditions: -// -// The above copyright notice and this permission notice shall be included -// in all copies or substantial portions of the Software. -// -// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS -// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN -// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, -// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR -// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE -// USE OR OTHER DEALINGS IN THE SOFTWARE. - -'use strict'; -const common = require('../common'); -if (!common.hasCrypto) { - common.skip('missing crypto'); -} - -const { hasOpenSSL } = require('../common/crypto'); -const crypto = require('crypto'); - -if (crypto.getFips()) { - common.skip('BF-ECB is not FIPS 140-2 compatible'); -} - -if (hasOpenSSL(3)) { - common.skip('Blowfish is only available with the legacy provider in ' + - 'OpenSSl 3.x'); -} - -if (!crypto.getCiphers().includes('BF-ECB')) { - common.skip('BF-ECB cipher is not available'); -} - -const assert = require('assert'); - -// Testing whether EVP_CipherInit_ex is functioning correctly. -// Reference: bug#1997 - -{ - const encrypt = - crypto.createCipheriv('BF-ECB', 'SomeRandomBlahz0c5GZVnR', ''); - let hex = encrypt.update('Hello World!', 'ascii', 'hex'); - hex += encrypt.final('hex'); - assert.strictEqual(hex.toUpperCase(), '6D385F424AAB0CFBF0BB86E07FFB7D71'); -} - -{ - const decrypt = - crypto.createDecipheriv('BF-ECB', 'SomeRandomBlahz0c5GZVnR', ''); - let msg = decrypt.update('6D385F424AAB0CFBF0BB86E07FFB7D71', 'hex', 'ascii'); - msg += decrypt.final('ascii'); - assert.strictEqual(msg, 'Hello World!'); -} diff --git a/test/parallel/test-crypto-encap-decap.js b/test/parallel/test-crypto-encap-decap.js index 199ad68fa36..50a44f91051 100644 --- a/test/parallel/test-crypto-encap-decap.js +++ b/test/parallel/test-crypto-encap-decap.js @@ -16,11 +16,6 @@ const { promisify } = require('util'); const isBoringSSL = commonIsBoringSSL; const isFips = hasFIPS(3); -if (!hasOpenSSL(3) && !isBoringSSL) { - assert.throws(() => crypto.encapsulate(), { code: 'ERR_CRYPTO_KEM_NOT_SUPPORTED' }); - return; -} - assert.throws(() => crypto.encapsulate(), { code: 'ERR_INVALID_ARG_TYPE', message: /The "key" argument must be of type/ }); assert.throws(() => crypto.decapsulate(), { code: 'ERR_INVALID_ARG_TYPE', @@ -28,7 +23,7 @@ assert.throws(() => crypto.decapsulate(), { code: 'ERR_INVALID_ARG_TYPE', const keys = { 'rsa': { - supported: hasOpenSSL(3), // RSASVE was added in 3.0 + supported: !isBoringSSL, // BoringSSL does not support RSASVE publicKey: fixtures.readKey('rsa_public_2048.pem', 'ascii'), privateKey: fixtures.readKey('rsa_private_2048.pem', 'ascii'), sharedSecretLength: 256, diff --git a/test/parallel/test-crypto-fips-indicator-strict.js b/test/parallel/test-crypto-fips-indicator-strict.js index 5e003d7015b..b1024fc5235 100644 --- a/test/parallel/test-crypto-fips-indicator-strict.js +++ b/test/parallel/test-crypto-fips-indicator-strict.js @@ -31,7 +31,7 @@ const mode = process.env.NODE_TEST_FIPS_FORCE_MODE; if (!hasOpenSSL(3, 4)) { common.skip('OpenSSL 3.4 or later is required'); } else if (!hasFIPS(3, 4)) { - common.skip('an active OpenSSL 3.4+ FIPS provider is required'); + common.skip('an active OpenSSL FIPS provider is required'); } else if (mode === 'provider') { assertSerializedMode(mode); assert.strictEqual( diff --git a/test/parallel/test-crypto-getcipherinfo.js b/test/parallel/test-crypto-getcipherinfo.js index 4c8e0c01c08..1eeefaaf366 100644 --- a/test/parallel/test-crypto-getcipherinfo.js +++ b/test/parallel/test-crypto-getcipherinfo.js @@ -10,7 +10,7 @@ const { getCiphers, getCipherInfo, } = require('crypto'); -const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); @@ -18,7 +18,7 @@ const ciphers = getCiphers(); assert.strictEqual(getCipherInfo(-1), undefined); assert.strictEqual(getCipherInfo('cipher that does not exist'), undefined); -if (hasOpenSSL(3)) { +if (!isBoringSSL) { assert.deepStrictEqual( ciphers.filter((cipher) => cipher.includes('cbc-hmac')), []); for (const cipher of [ diff --git a/test/parallel/test-crypto-hkdf.js b/test/parallel/test-crypto-hkdf.js index 7051c2fae07..88be6098725 100644 --- a/test/parallel/test-crypto-hkdf.js +++ b/test/parallel/test-crypto-hkdf.js @@ -13,7 +13,7 @@ const { hkdfSync, getHashes } = require('crypto'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); { assert.throws(() => hkdf(), { @@ -142,9 +142,6 @@ const algorithms = [ ['sha256', '', 'salt', '', 10], ['sha512', 'secret', 'salt', '', 15], ]; -if (!hasOpenSSL(3) && !isBoringSSL) - algorithms.push(['whirlpool', 'secret', '', 'info', 20]); - algorithms.forEach(([ hash, secret, salt, info, length ]) => { { const syncResult = hkdfSync(hash, secret, salt, info, length); @@ -233,7 +230,7 @@ algorithms.forEach(([ hash, secret, salt, info, length ]) => { }); -if (!hasOpenSSL(3)) { +if (isBoringSSL) { const kKnownUnsupported = ['shake128', 'shake256']; for (const hash of getHashes()) { if (kKnownUnsupported.includes(hash)) continue; diff --git a/test/parallel/test-crypto-hmac.js b/test/parallel/test-crypto-hmac.js index 1e19b3e972d..116daa5f311 100644 --- a/test/parallel/test-crypto-hmac.js +++ b/test/parallel/test-crypto-hmac.js @@ -69,19 +69,6 @@ function testHmac(algo, key, data, expected) { '19fd6e1ba73d9ed2224dd5094a71babe85d9a892'); } -{ - // Historically, dss1 and DSS1 are SHA-1 aliases. - const key = '0123456789abcdef'; - const expected = - crypto.createHmac('sha1', key).update('data').digest('hex'); - - for (const algo of ['dss1', 'DSS1']) { - assert.strictEqual( - crypto.createHmac(algo, key).update('data').digest('hex'), - expected); - } -} - // Test HMAC (Wikipedia Test Cases) const wikipedia = [ { diff --git a/test/parallel/test-crypto-job-error-parity.js b/test/parallel/test-crypto-job-error-parity.js index ee9bd27bba6..06cb3c93b14 100644 --- a/test/parallel/test-crypto-job-error-parity.js +++ b/test/parallel/test-crypto-job-error-parity.js @@ -8,7 +8,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const crypto = require('crypto'); const fixtures = require('../common/fixtures'); @@ -195,7 +195,7 @@ const data = Buffer.from('test data'); } // === crypto.encapsulate / crypto.decapsulate === -if (hasOpenSSL(3)) { +if (!isBoringSSL) { // KEM: Decapsulate with wrong private key type { const rsaPublicKey = crypto.createPublicKey( diff --git a/test/parallel/test-crypto-kem-shared-key.js b/test/parallel/test-crypto-kem-shared-key.js index da28d5b4134..bc0e8e57811 100644 --- a/test/parallel/test-crypto-kem-shared-key.js +++ b/test/parallel/test-crypto-kem-shared-key.js @@ -18,9 +18,6 @@ const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const fixtures = require('../common/fixtures'); const { subtle } = globalThis.crypto; -if (!hasOpenSSL(3) && !isBoringSSL) - common.skip('requires OpenSSL >= 3 or BoringSSL'); - const encapsulateAsync = promisify(encapsulate); const decapsulateAsync = promisify(decapsulate); @@ -103,7 +100,7 @@ async function testKeys(keys) { async function runMain() { const types = []; - if (hasOpenSSL(3)) { + if (!isBoringSSL) { types.push(['rsa', 'rsa', 256, 256]); } if (hasOpenSSL(3, 2) && !hasFIPS(3)) { diff --git a/test/parallel/test-crypto-key-encoding-provider-cipher.js b/test/parallel/test-crypto-key-encoding-provider-cipher.js index 3ded8ed0a62..3f2c3dafd97 100644 --- a/test/parallel/test-crypto-key-encoding-provider-cipher.js +++ b/test/parallel/test-crypto-key-encoding-provider-cipher.js @@ -4,8 +4,8 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (isBoringSSL || !hasOpenSSL(3)) +const { hasFIPS, isBoringSSL } = require('../common/crypto'); +if (isBoringSSL) common.skip('OpenSSL providers are required'); const assert = require('assert'); diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js index 97810af5d9c..759f2af4399 100644 --- a/test/parallel/test-crypto-key-objects.js +++ b/test/parallel/test-crypto-key-objects.js @@ -25,7 +25,6 @@ const { } = require('crypto'); const { - hasOpenSSL, hasFIPS, isBoringSSL, } = require('../common/crypto'); @@ -350,20 +349,14 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem', // This should not cause a crash: https://github.com/nodejs/node/issues/25247 assert.throws(() => { createPrivateKey({ key: '' }); - }, hasOpenSSL(3) ? { - message: 'error:1E08010C:DECODER routines::unsupported', - } : isBoringSSL ? { + }, isBoringSSL ? { message: 'error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE', code: 'ERR_OSSL_PEM_NO_START_LINE', reason: 'NO_START_LINE', library: 'PEM routines', function: 'OPENSSL_internal', } : { - message: 'error:0909006C:PEM routines:get_name:no start line', - code: 'ERR_OSSL_PEM_NO_START_LINE', - reason: 'no start line', - library: 'PEM routines', - function: 'get_name', + message: 'error:1E08010C:DECODER routines::unsupported', }); // This should not abort either: https://github.com/nodejs/node/issues/29904 @@ -382,15 +375,12 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem', type: 'pkcs1' }); createPrivateKey({ key, format: 'der', type: 'pkcs1' }); - }, hasOpenSSL(3) ? { - message: /error:1E08010C:DECODER routines::unsupported/, - library: 'DECODER routines' - } : isBoringSSL ? { + }, isBoringSSL ? { library: 'public key routines', message: 'error:06000066:public key routines:OPENSSL_internal:DECODE_ERROR' } : { - message: /asn1 encoding/, - library: 'asn1 encoding routines' + message: /error:1E08010C:DECODER routines::unsupported/, + library: 'DECODER routines' }); } @@ -791,14 +781,14 @@ for (const info of [ { // Reading an encrypted key without a passphrase should fail. - assert.throws(() => createPrivateKey(privateDsa), hasOpenSSL(3) ? { - name: 'Error', - message: 'error:07880109:common libcrypto routines::interrupted or ' + - 'cancelled', - } : { + assert.throws(() => createPrivateKey(privateDsa), isBoringSSL ? { name: 'TypeError', code: 'ERR_MISSING_PASSPHRASE', message: 'Passphrase required for encrypted key' + } : { + name: 'Error', + message: 'error:07880109:common libcrypto routines::interrupted or ' + + 'cancelled', }); // Reading an encrypted key with a passphrase that exceeds OpenSSL's buffer @@ -807,10 +797,10 @@ for (const info of [ key: privateDsa, format: 'pem', passphrase: Buffer.alloc(1025, 'a') - }), hasOpenSSL(3) ? { name: 'Error' } : { + }), isBoringSSL ? { code: 'ERR_OSSL_PEM_BAD_PASSWORD_READ', name: 'Error' - }); + } : { name: 'Error' }); // The buffer has a size of 1024 bytes, so this passphrase should be permitted // (but will fail decryption). diff --git a/test/parallel/test-crypto-key-store-pkcs11.js b/test/parallel/test-crypto-key-store-pkcs11.js index fe3158b0cd5..56855b0d63e 100644 --- a/test/parallel/test-crypto-key-store-pkcs11.js +++ b/test/parallel/test-crypto-key-store-pkcs11.js @@ -3,9 +3,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); -if (!hasOpenSSL(3, 0)) - common.skip('requires OpenSSL 3.x'); +const { isBoringSSL } = require('../common/crypto'); +if (isBoringSSL) + common.skip('OpenSSL provider support is required'); // The PKCS#11 token, the OpenSSL configuration that activates a provider for // it, and the PIN that unlocks it are all provided by the environment. See diff --git a/test/parallel/test-crypto-key-store.js b/test/parallel/test-crypto-key-store.js index d5636f350dc..8c8032cb5fb 100644 --- a/test/parallel/test-crypto-key-store.js +++ b/test/parallel/test-crypto-key-store.js @@ -2,9 +2,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasFIPS, hasOpenSSL } = require('../common/crypto'); -if (!hasOpenSSL(3)) - common.skip('requires OpenSSL 3.x'); +const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto'); +if (isBoringSSL) + common.skip('OpenSSL provider support is required'); // Verifies that crypto.createPrivateKey() can pass a WHATWG URL (here a file: // URI) to an OpenSSL STORE loader, and that the resulting KeyObject works for diff --git a/test/parallel/test-crypto-keygen-async-dsa-key-object.js b/test/parallel/test-crypto-keygen-async-dsa-key-object.js index 52c82ea5725..9527383692a 100644 --- a/test/parallel/test-crypto-keygen-async-dsa-key-object.js +++ b/test/parallel/test-crypto-keygen-async-dsa-key-object.js @@ -4,7 +4,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { isBoringSSL, hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); if (isBoringSSL) common.skip('not supported by BoringSSL'); @@ -17,20 +17,20 @@ const { // Test async DSA key object generation. { generateKeyPair('dsa', { - modulusLength: hasOpenSSL(3) ? 2048 : 512, + modulusLength: 2048, divisorLength: 256 }, common.mustSucceed((publicKey, privateKey) => { assert.strictEqual(publicKey.type, 'public'); assert.strictEqual(publicKey.asymmetricKeyType, 'dsa'); assert.deepStrictEqual(publicKey.asymmetricKeyDetails, { - modulusLength: hasOpenSSL(3) ? 2048 : 512, + modulusLength: 2048, divisorLength: 256 }); assert.strictEqual(privateKey.type, 'private'); assert.strictEqual(privateKey.asymmetricKeyType, 'dsa'); assert.deepStrictEqual(privateKey.asymmetricKeyDetails, { - modulusLength: hasOpenSSL(3) ? 2048 : 512, + modulusLength: 2048, divisorLength: 256 }); })); diff --git a/test/parallel/test-crypto-keygen-async-dsa.js b/test/parallel/test-crypto-keygen-async-dsa.js index 5d0254491cd..884b4eca7db 100644 --- a/test/parallel/test-crypto-keygen-async-dsa.js +++ b/test/parallel/test-crypto-keygen-async-dsa.js @@ -9,7 +9,6 @@ const { assertApproximateSize, testSignVerify, spkiExp, - hasOpenSSL, } = require('../common/crypto'); if (isBoringSSL) @@ -19,7 +18,6 @@ const assert = require('assert'); const { generateKeyPair, } = require('crypto'); - // Test async DSA key generation. { const privateKeyEncoding = { @@ -28,7 +26,7 @@ const { }; generateKeyPair('dsa', { - modulusLength: hasOpenSSL(3) ? 2048 : 512, + modulusLength: 2048, divisorLength: 256, publicKeyEncoding: { type: 'spki', @@ -45,8 +43,8 @@ const { // The private key is DER-encoded. assert(Buffer.isBuffer(privateKeyDER)); - assertApproximateSize(publicKey, hasOpenSSL(3) ? 1194 : 440); - assertApproximateSize(privateKeyDER, hasOpenSSL(3) ? 721 : 336); + assertApproximateSize(publicKey, 1194); + assertApproximateSize(privateKeyDER, 721); // Since the private key is encrypted, signing shouldn't work anymore. assert.throws(() => { diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js index cd7e59be97f..b876596df61 100644 --- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js +++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js @@ -9,7 +9,6 @@ const { testSignVerify, spkiExp, pkcs8EncExp, - hasOpenSSL, } = require('../common/crypto'); if (isBoringSSL) @@ -19,7 +18,6 @@ const assert = require('assert'); const { generateKeyPair, } = require('crypto'); - // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted // private key with paramEncoding explicit. { @@ -44,13 +42,9 @@ const { // Since the private key is encrypted, signing shouldn't work anymore. assert.throws(() => testSignVerify(publicKey, privateKey), - hasOpenSSL(3) ? { + { message: 'error:07880109:common libcrypto ' + 'routines::interrupted or cancelled' - } : { - name: 'TypeError', - code: 'ERR_MISSING_PASSPHRASE', - message: 'Passphrase required for encrypted key' }); testSignVerify(publicKey, { diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js index 5c0878fc634..f79b92eeae2 100644 --- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js +++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js @@ -10,7 +10,6 @@ const { testSignVerify, spkiExp, sec1EncExp, - hasOpenSSL, } = require('../common/crypto'); if (isBoringSSL) @@ -50,13 +49,9 @@ const { // Since the private key is encrypted, signing shouldn't work anymore. assert.throws(() => testSignVerify(publicKey, privateKey), - hasOpenSSL(3) ? { + { message: 'error:07880109:common libcrypto ' + 'routines::interrupted or cancelled' - } : { - name: 'TypeError', - code: 'ERR_MISSING_PASSPHRASE', - message: 'Passphrase required for encrypted key' }); testSignVerify(publicKey, { key: privateKey, passphrase: 'secret' }); diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js index ba86fcdb94e..545190bbc48 100644 --- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js +++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js @@ -12,7 +12,7 @@ const { testSignVerify, spkiExp, pkcs8EncExp, - hasOpenSSL, + isBoringSSL, } = require('../common/crypto'); // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted @@ -39,13 +39,13 @@ const { // Since the private key is encrypted, signing shouldn't work anymore. assert.throws(() => testSignVerify(publicKey, privateKey), - hasOpenSSL(3) ? { - message: 'error:07880109:common libcrypto ' + - 'routines::interrupted or cancelled' - } : { + isBoringSSL ? { name: 'TypeError', code: 'ERR_MISSING_PASSPHRASE', message: 'Passphrase required for encrypted key' + } : { + message: 'error:07880109:common libcrypto ' + + 'routines::interrupted or cancelled' }); testSignVerify(publicKey, { diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js index 84ea9d2f7a9..82f8705a280 100644 --- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js +++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js @@ -13,7 +13,7 @@ const { testSignVerify, spkiExp, sec1EncExp, - hasOpenSSL, + isBoringSSL, } = require('../common/crypto'); { @@ -45,13 +45,13 @@ const { // Since the private key is encrypted, signing shouldn't work anymore. assert.throws(() => testSignVerify(publicKey, privateKey), - hasOpenSSL(3) ? { - message: 'error:07880109:common libcrypto ' + - 'routines::interrupted or cancelled' - } : { + isBoringSSL ? { name: 'TypeError', code: 'ERR_MISSING_PASSPHRASE', message: 'Passphrase required for encrypted key' + } : { + message: 'error:07880109:common libcrypto ' + + 'routines::interrupted or cancelled' }); testSignVerify(publicKey, { key: privateKey, passphrase: 'secret' }); diff --git a/test/parallel/test-crypto-keygen-async-rsa.js b/test/parallel/test-crypto-keygen-async-rsa.js index 7a372ded9fc..19f83bc3882 100644 --- a/test/parallel/test-crypto-keygen-async-rsa.js +++ b/test/parallel/test-crypto-keygen-async-rsa.js @@ -14,7 +14,7 @@ const { testEncryptDecrypt, testSignVerify, pkcs1EncExp, - hasOpenSSL, + isBoringSSL, } = require('../common/crypto'); // Test async RSA key generation with an encrypted private key. @@ -51,14 +51,14 @@ const { type: 'pkcs1', format: 'der', }; - const expectedError = hasOpenSSL(3) ? { - name: 'Error', - message: 'error:07880109:common libcrypto routines::interrupted or ' + - 'cancelled' - } : { + const expectedError = isBoringSSL ? { name: 'TypeError', code: 'ERR_MISSING_PASSPHRASE', message: 'Passphrase required for encrypted key' + } : { + name: 'Error', + message: 'error:07880109:common libcrypto routines::interrupted or ' + + 'cancelled' }; assert.throws(() => testSignVerify(publicKey, privateKey), expectedError); diff --git a/test/parallel/test-crypto-keygen-bit-length.js b/test/parallel/test-crypto-keygen-bit-length.js index 90d32cd73bc..2c37ef18798 100644 --- a/test/parallel/test-crypto-keygen-bit-length.js +++ b/test/parallel/test-crypto-keygen-bit-length.js @@ -6,7 +6,6 @@ if (!common.hasCrypto) const { isBoringSSL, - hasOpenSSL, hasFIPS, } = require('../common/crypto'); @@ -18,7 +17,6 @@ const assert = require('assert'); const { generateKeyPair, } = require('crypto'); - const fips3 = hasFIPS(3); // This tests check that generateKeyPair returns correct bit length in @@ -49,18 +47,16 @@ const fips3 = hasFIPS(3); assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 513); })); - if (hasOpenSSL(3)) { - generateKeyPair('dsa', { - modulusLength: 2049, - divisorLength: 256, - }, common.mustCall((err, publicKey, privateKey) => { - if (fips3) { - assert.strictEqual(err?.code, 'ERR_OSSL_DSA_BAD_FFC_PARAMETERS'); - return; - } - assert.ifError(err); - assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 2049); - assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 2049); - })); - } + generateKeyPair('dsa', { + modulusLength: 2049, + divisorLength: 256, + }, common.mustCall((err, publicKey, privateKey) => { + if (fips3) { + assert.strictEqual(err?.code, 'ERR_OSSL_DSA_BAD_FFC_PARAMETERS'); + return; + } + assert.ifError(err); + assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 2049); + assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 2049); + })); } diff --git a/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js b/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js index ccf98bcd376..9f2fc9b55c8 100644 --- a/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js +++ b/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js @@ -12,7 +12,7 @@ const { const { hasFIPS, testSignVerify, - hasOpenSSL, + isBoringSSL, } = require('../common/crypto'); const fips4 = hasFIPS(4); @@ -56,14 +56,14 @@ for (const type of ['pkcs1', 'pkcs8']) { // the key, and not specifying a passphrase should fail when decoding it. assert.throws(() => { return testSignVerify(publicKey, privateKey); - }, hasOpenSSL(3) ? { - name: 'Error', - code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED', - message: 'error:07880109:common libcrypto routines::interrupted or cancelled' - } : { + }, isBoringSSL ? { name: 'TypeError', code: 'ERR_MISSING_PASSPHRASE', message: 'Passphrase required for encrypted key' + } : { + name: 'Error', + code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED', + message: 'error:07880109:common libcrypto routines::interrupted or cancelled' }); })); } diff --git a/test/parallel/test-crypto-keygen-missing-oid.js b/test/parallel/test-crypto-keygen-missing-oid.js index afe95dbee40..6fd81184480 100644 --- a/test/parallel/test-crypto-keygen-missing-oid.js +++ b/test/parallel/test-crypto-keygen-missing-oid.js @@ -11,36 +11,34 @@ const { getCurves, } = require('crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); // This test creates EC key pairs on curves without associated OIDs. // Specifying a key encoding should not crash. { - if (process.versions.openssl >= '1.1.1i') { - for (const namedCurve of ['Oakley-EC2N-3', 'Oakley-EC2N-4']) { - if (!getCurves().includes(namedCurve)) - continue; + for (const namedCurve of ['Oakley-EC2N-3', 'Oakley-EC2N-4']) { + if (!getCurves().includes(namedCurve)) + continue; - const expectedErrorCode = - hasFIPS(3) ? 'ERR_OSSL_EC_UNKNOWN_GROUP' : - hasOpenSSL(3) ? 'ERR_OSSL_MISSING_OID' : 'ERR_OSSL_EC_MISSING_OID'; - const params = { - namedCurve, - publicKeyEncoding: { - format: 'der', - type: 'spki' - } - }; + const expectedErrorCode = + hasFIPS(3) ? 'ERR_OSSL_EC_UNKNOWN_GROUP' : + isBoringSSL ? 'ERR_OSSL_EC_MISSING_OID' : 'ERR_OSSL_MISSING_OID'; + const params = { + namedCurve, + publicKeyEncoding: { + format: 'der', + type: 'spki' + } + }; - assert.throws(() => { - generateKeyPairSync('ec', params); - }, { - code: expectedErrorCode - }); + assert.throws(() => { + generateKeyPairSync('ec', params); + }, { + code: expectedErrorCode + }); - generateKeyPair('ec', params, common.mustCall((err) => { - assert.strictEqual(err.code, expectedErrorCode); - })); - } + generateKeyPair('ec', params, common.mustCall((err) => { + assert.strictEqual(err.code, expectedErrorCode); + })); } } diff --git a/test/parallel/test-crypto-keygen.js b/test/parallel/test-crypto-keygen.js index a68c7c07c93..37cb2629419 100644 --- a/test/parallel/test-crypto-keygen.js +++ b/test/parallel/test-crypto-keygen.js @@ -14,11 +14,7 @@ const { } = require('crypto'); const { inspect } = require('util'); -const { - hasOpenSSL, - isBoringSSL: commonIsBoringSSL, -} = require('../common/crypto'); -const isBoringSSL = commonIsBoringSSL; +const { isBoringSSL } = require('../common/crypto'); // Test invalid parameter encoding. { @@ -379,12 +375,7 @@ const isBoringSSL = commonIsBoringSSL; } // Test invalid exponents. (caught by OpenSSL) - let invalidExponentError = /bad e value/; - if (isBoringSSL) { - invalidExponentError = /BAD_E_VALUE/; - } else if (hasOpenSSL(3)) { - invalidExponentError = /exponent/; - } + const invalidExponentError = isBoringSSL ? /BAD_E_VALUE/ : /exponent/; for (const publicExponent of [1, 1 + 0x10001]) { generateKeyPair('rsa', { modulusLength: 4096, diff --git a/test/parallel/test-crypto-mac-errors.js b/test/parallel/test-crypto-mac-errors.js index 8bc8cebfcf5..7326ee88e95 100644 --- a/test/parallel/test-crypto-mac-errors.js +++ b/test/parallel/test-crypto-mac-errors.js @@ -6,10 +6,10 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3) || isBoringSSL) { - common.skip('OpenSSL 3 EVP_MAC support is required'); +if (isBoringSSL) { + common.skip('OpenSSL EVP_MAC support is required'); } const assert = require('node:assert'); diff --git a/test/parallel/test-crypto-mac-unsupported.js b/test/parallel/test-crypto-mac-unsupported.js index 1721e9d1c1a..84fa4299667 100644 --- a/test/parallel/test-crypto-mac-unsupported.js +++ b/test/parallel/test-crypto-mac-unsupported.js @@ -6,9 +6,9 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); -if (hasOpenSSL(3) && !isBoringSSL) { +if (!isBoringSSL) { common.skip('this test requires a build without EVP_MAC support'); } diff --git a/test/parallel/test-crypto-mac-vectors.js b/test/parallel/test-crypto-mac-vectors.js index 19544ccf4ec..7e965f78618 100644 --- a/test/parallel/test-crypto-mac-vectors.js +++ b/test/parallel/test-crypto-mac-vectors.js @@ -8,10 +8,10 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3) || isBoringSSL) { - common.skip('OpenSSL 3 EVP_MAC support is required'); +if (isBoringSSL) { + common.skip('OpenSSL EVP_MAC support is required'); } const assert = require('node:assert'); diff --git a/test/parallel/test-crypto-mac.js b/test/parallel/test-crypto-mac.js index deb2a8a3d32..267eea0e1ad 100644 --- a/test/parallel/test-crypto-mac.js +++ b/test/parallel/test-crypto-mac.js @@ -8,10 +8,10 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3) || isBoringSSL) { - common.skip('OpenSSL 3 EVP_MAC support is required'); +if (isBoringSSL) { + common.skip('OpenSSL EVP_MAC support is required'); } const assert = require('node:assert'); diff --git a/test/parallel/test-crypto-negative-zero.js b/test/parallel/test-crypto-negative-zero.js index 0e9525fcaf6..8bf5d305a2f 100644 --- a/test/parallel/test-crypto-negative-zero.js +++ b/test/parallel/test-crypto-negative-zero.js @@ -6,7 +6,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); function getOutcome(fn) { try { @@ -88,9 +88,9 @@ function assertSameErrorOrSuccess(actual, expected) { ); } - if (!hasOpenSSL(3)) { + if (isBoringSSL) { common.printSkipMessage( - 'Skipping DSA divisorLength 0 key generation on OpenSSL 1.1.1'); + 'BoringSSL does not support DSA key pair generation'); } else { assertSameErrorOrSuccess( getOutcome(() => crypto.generateKeyPairSync('dsa', { diff --git a/test/parallel/test-crypto-no-algorithm.js b/test/parallel/test-crypto-no-algorithm.js index 06aab7614ff..e0a37230b84 100644 --- a/test/parallel/test-crypto-no-algorithm.js +++ b/test/parallel/test-crypto-no-algorithm.js @@ -4,10 +4,10 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3)) - common.skip('this test requires OpenSSL 3.x'); +if (isBoringSSL) + common.skip('this test requires OpenSSL'); const assert = require('node:assert/strict'); const crypto = require('node:crypto'); diff --git a/test/parallel/test-crypto-padding.js b/test/parallel/test-crypto-padding.js index dce34409400..7ad837c64b2 100644 --- a/test/parallel/test-crypto-padding.js +++ b/test/parallel/test-crypto-padding.js @@ -26,7 +26,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); // Input data. const ODD_LENGTH_PLAIN = 'Hello node world!'; @@ -83,14 +83,14 @@ assert.strictEqual(enc(EVEN_LENGTH_PLAIN, true), EVEN_LENGTH_ENCRYPTED); assert.throws(function() { // Input must have block length %. enc(ODD_LENGTH_PLAIN, false); -}, hasOpenSSL(3) ? { - message: /wrong[\s_]final[\s_]block[\s_]length/i, - code: /ERR_OSSL(_EVP)?_WRONG_FINAL_BLOCK_LENGTH/, - reason: /wrong[\s_]final[\s_]block[\s_]length/i, -} : { +}, isBoringSSL ? { message: /data[\s_]not[\s_]multiple[\s_]of[\s_]block[\s_]length/i, code: /ERR_OSSL(_EVP)?_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH/, reason: /data[\s_]not[\s_]multiple[\s_]of[\s_]block[\s_]length/i, +} : { + message: /wrong[\s_]final[\s_]block[\s_]length/i, + code: /ERR_OSSL(_EVP)?_WRONG_FINAL_BLOCK_LENGTH/, + reason: /wrong[\s_]final[\s_]block[\s_]length/i, } ); diff --git a/test/parallel/test-crypto-pbkdf2.js b/test/parallel/test-crypto-pbkdf2.js index 5083396f733..3fe2645e2db 100644 --- a/test/parallel/test-crypto-pbkdf2.js +++ b/test/parallel/test-crypto-pbkdf2.js @@ -6,8 +6,8 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); const { - hasOpenSSL, hasFIPS, + isBoringSSL, } = require('../common/crypto'); const fips4 = hasFIPS(4); @@ -335,7 +335,7 @@ assert.throws( } ); -if (!hasOpenSSL(3)) { +if (isBoringSSL) { const kNotPBKDF2Supported = ['shake128', 'shake256']; crypto.getHashes() .filter((hash) => !kNotPBKDF2Supported.includes(hash)) diff --git a/test/parallel/test-crypto-pkcs12.js b/test/parallel/test-crypto-pkcs12.js index 0ec9a2f544d..1e65bf20a45 100644 --- a/test/parallel/test-crypto-pkcs12.js +++ b/test/parallel/test-crypto-pkcs12.js @@ -5,7 +5,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); const crypto = require('crypto'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL3, hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const fips3 = hasFIPS(3); @@ -140,7 +140,7 @@ if (!fips3) { assert.ok(additionalCertificates[0] instanceof crypto.X509Certificate); } -if (hasOpenSSL3) { +if (!isBoringSSL) { // Legacy algorithms (RC2-40-CBC) throw a recognizable, actionable error // rather than a bare OpenSSL string. Mirrors the behavior added for the // TLS path in https://github.com/nodejs/node/pull/54485. diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js index cd8f8c926f5..1fb0fa19f08 100644 --- a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js +++ b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js @@ -102,12 +102,12 @@ for (const [asymmetricKeyType, pubLen] of [ if (!hasOpenSSL(3, 5) && !isBoringSSL) { assert.throws(() => createPublicKey(keys.public), { - code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM', + code: 'ERR_OSSL_EVP_DECODE_ERROR', }); for (const pem of [keys.private, keys.private_seed_only, keys.private_priv_only]) { assert.throws(() => createPrivateKey(pem), { - code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM', + code: 'ERR_OSSL_UNSUPPORTED', }); } } else { diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js index d08a479f421..7ae706af400 100644 --- a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js +++ b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js @@ -102,12 +102,12 @@ for (const [asymmetricKeyType, pubLen] of [ if (!hasOpenSSL(3, 5) && !isBoringSSL) { assert.throws(() => createPublicKey(keys.public), { - code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM', + code: 'ERR_OSSL_EVP_DECODE_ERROR', }); for (const pem of [keys.private, keys.private_seed_only, keys.private_priv_only]) { assert.throws(() => createPrivateKey(pem), { - code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM', + code: 'ERR_OSSL_UNSUPPORTED', }); } } else if (isBoringSSL && asymmetricKeyType === 'ml-kem-512') { diff --git a/test/parallel/test-crypto-pqc-key-objects-slh-dsa.js b/test/parallel/test-crypto-pqc-key-objects-slh-dsa.js index eff309468c3..090aa65f9dc 100644 --- a/test/parallel/test-crypto-pqc-key-objects-slh-dsa.js +++ b/test/parallel/test-crypto-pqc-key-objects-slh-dsa.js @@ -4,7 +4,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { @@ -101,11 +101,11 @@ for (const asymmetricKeyType of [ if (!hasOpenSSL(3, 5)) { assert.throws(() => createPublicKey(keys.public), { - code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM', + code: isBoringSSL ? 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM' : 'ERR_OSSL_EVP_DECODE_ERROR', }); assert.throws(() => createPrivateKey(keys.private), { - code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM', + code: isBoringSSL ? 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM' : 'ERR_OSSL_UNSUPPORTED', }); } else { const publicKey = createPublicKey(keys.public); diff --git a/test/parallel/test-crypto-prime.js b/test/parallel/test-crypto-prime.js index 6f43e3a0bfb..0831aee23e4 100644 --- a/test/parallel/test-crypto-prime.js +++ b/test/parallel/test-crypto-prime.js @@ -5,6 +5,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); +const { isBoringSSL } = require('../common/crypto'); const { generatePrime, @@ -165,7 +166,7 @@ generatePrime( // The behavior when specifying only add without rem should depend on the // safe option. - if (process.versions.openssl >= '1.1.1f') { + if (!isBoringSSL) { generatePrime(128, { bigint: true, add: 5n @@ -215,7 +216,7 @@ generatePrime( code: 'ERR_OUT_OF_RANGE' }); - if (process.versions.openssl >= '1.1.1f') { + if (!isBoringSSL) { // This is possible and allowed (but makes little sense). assert.strictEqual(generatePrimeSync(4, { add: 15n, diff --git a/test/parallel/test-crypto-private-decrypt-gh32240.js b/test/parallel/test-crypto-private-decrypt-gh32240.js index a38fcba6775..1e6c2d7626f 100644 --- a/test/parallel/test-crypto-private-decrypt-gh32240.js +++ b/test/parallel/test-crypto-private-decrypt-gh32240.js @@ -15,8 +15,8 @@ const { } = require('crypto'); const { - hasOpenSSL, hasFIPS, + isBoringSSL, } = require('../common/crypto'); const fips3 = hasFIPS(3); @@ -64,8 +64,8 @@ function decrypt(key) { } decrypt(pkey); -assert.throws(() => decrypt(pkeyEncrypted), hasOpenSSL(3) ? +assert.throws(() => decrypt(pkeyEncrypted), isBoringSSL ? + { code: 'ERR_MISSING_PASSPHRASE' } : { message: 'error:07880109:common libcrypto routines::interrupted or ' + - 'cancelled' } : - { code: 'ERR_MISSING_PASSPHRASE' }); + 'cancelled' }); decrypt(pkey); // Should not throw. diff --git a/test/parallel/test-crypto-provider-cache-snapshot.js b/test/parallel/test-crypto-provider-cache-snapshot.js index 522dedfc436..c6a06887512 100644 --- a/test/parallel/test-crypto-provider-cache-snapshot.js +++ b/test/parallel/test-crypto-provider-cache-snapshot.js @@ -5,13 +5,13 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('node:assert'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); const fixtures = require('../common/fixtures'); const tmpdir = require('../common/tmpdir'); const { buildSnapshot, runWithSnapshot } = require('../common/snapshot'); -if (!hasOpenSSL(3) || isBoringSSL) - common.skip('this test requires OpenSSL 3.x'); +if (isBoringSSL) + common.skip('OpenSSL provider support is required'); const entry = fixtures.path('snapshot', 'crypto-provider-cache.js'); const buildEnv = { diff --git a/test/parallel/test-crypto-provider-cache.js b/test/parallel/test-crypto-provider-cache.js index bbfee76b615..2d57b63e523 100644 --- a/test/parallel/test-crypto-provider-cache.js +++ b/test/parallel/test-crypto-provider-cache.js @@ -5,9 +5,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3) || isBoringSSL) - common.skip('this test requires OpenSSL 3 provider support'); +const { isBoringSSL } = require('../common/crypto'); +if (isBoringSSL) + common.skip('this test requires OpenSSL provider support'); const assert = require('node:assert'); const crypto = require('node:crypto'); diff --git a/test/parallel/test-crypto-provider-hash-options.js b/test/parallel/test-crypto-provider-hash-options.js index ecccc02f01e..997b179413a 100644 --- a/test/parallel/test-crypto-provider-hash-options.js +++ b/test/parallel/test-crypto-provider-hash-options.js @@ -11,7 +11,7 @@ if (!common.hasCrypto) { if (Number(process.versions.openssl.split('.')[0]) < 4 || isBoringSSL) { - common.skip('OpenSSL 4 provider support is required'); + common.skip('OpenSSL 4.0 or later is required'); } const assert = require('node:assert'); diff --git a/test/parallel/test-crypto-provider-hashes.js b/test/parallel/test-crypto-provider-hashes.js index 5e688303910..8953e2afa51 100644 --- a/test/parallel/test-crypto-provider-hashes.js +++ b/test/parallel/test-crypto-provider-hashes.js @@ -26,10 +26,10 @@ const { sign, verify, } = require('node:crypto'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3) || isBoringSSL) { - common.skip('OpenSSL 3 provider support is required'); +if (isBoringSSL) { + common.skip('OpenSSL provider support is required'); } const { internalBinding } = require('internal/test/binding'); diff --git a/test/parallel/test-crypto-publicDecrypt-fails-first-time.js b/test/parallel/test-crypto-publicDecrypt-fails-first-time.js index 21cc5f3ebce..297a6c24a3d 100644 --- a/test/parallel/test-crypto-publicDecrypt-fails-first-time.js +++ b/test/parallel/test-crypto-publicDecrypt-fails-first-time.js @@ -7,10 +7,10 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3)) { - common.skip('only openssl3'); // https://github.com/nodejs/node/pull/42793#issuecomment-1107491901 +if (isBoringSSL) { + common.skip('this test is not supported with BoringSSL'); // https://github.com/nodejs/node/pull/42793#issuecomment-1107491901 } const assert = require('assert'); diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js index 6e47d2a1865..e050796e856 100644 --- a/test/parallel/test-crypto-rsa-dsa.js +++ b/test/parallel/test-crypto-rsa-dsa.js @@ -16,9 +16,7 @@ const { } = require('../common/crypto'); const fips3 = hasFIPS(3); const fips35 = hasFIPS(3, 5); -const fips30 = fips3 && !fips35; const fips4 = hasFIPS(4); -const fipsDigestErrorCode = 'ERR_OSSL_DIGEST_NOT_ALLOWED'; const wrongPassphrase = 'wrong-password'; // Test certificates @@ -40,34 +38,25 @@ const dsaPkcs8KeyPem = fixtures.readKey('dsa_private_pkcs8.pem'); const ec = new TextEncoder(); -const openssl1DecryptError = { - message: 'error:06065064:digital envelope routines:EVP_DecryptFinal_ex:' + - 'bad decrypt', - code: 'ERR_OSSL_EVP_BAD_DECRYPT', - reason: 'bad decrypt', - function: 'EVP_DecryptFinal_ex', - library: 'digital envelope routines', -}; - const decryptError = fips4 ? - { code: 'ERR_OSSL_BAD_DECRYPT' } : hasOpenSSL(3) ? - { message: 'error:1C800064:Provider routines::bad decrypt' } : - isBoringSSL ? { - message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT', - code: 'ERR_OSSL_BAD_DECRYPT', - reason: 'BAD_DECRYPT', - function: 'OPENSSL_internal', - library: 'Cipher functions', - } : - openssl1DecryptError; + { code: 'ERR_OSSL_BAD_DECRYPT' } : + isBoringSSL ? { + message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT', + code: 'ERR_OSSL_BAD_DECRYPT', + reason: 'BAD_DECRYPT', + function: 'OPENSSL_internal', + library: 'Cipher functions', + } : { + message: 'error:1C800064:Provider routines::bad decrypt', + }; const decryptPrivateKeyError = fips4 ? { code: 'ERR_OSSL_BAD_DECRYPT', -} : hasOpenSSL(3) ? { - message: 'error:1C800064:Provider routines::bad decrypt', } : isBoringSSL ? { message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT', -} : openssl1DecryptError; +} : { + message: 'error:1C800064:Provider routines::bad decrypt', +}; function getBufferCopy(buf) { return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength); @@ -168,10 +157,8 @@ function getBufferCopy(buf) { }, encryptedBuffer); assert.strictEqual(decryptedBufferWithPassword.toString(), input); - // Now with RSA_NO_PADDING. Plaintext needs to match key size. - // OpenSSL 3.x has a rsa_check_padding that will cause an error if - // RSA_NO_PADDING is used. - if (!hasOpenSSL(3)) { + // BoringSSL does not apply OpenSSL's rsa_check_padding validation here. + if (isBoringSSL) { { const plaintext = 'x'.repeat(rsaKeySize / 8); encryptedBuffer = crypto.privateEncrypt({ @@ -541,21 +528,6 @@ if (!isBoringSSL) { assert.strictEqual(verify.verify(dsaPubPem, signature, 'hex'), true); - // Test the legacy 'DSS1' name. - const sign2 = crypto.createSign('DSS1'); - sign2.update(input); - if (fips30) { - assert.throws(() => sign2.sign(dsaKeyPem, 'hex'), { - code: fipsDigestErrorCode, - }); - } else { - const signature2 = sign2.sign(dsaKeyPem, 'hex'); - - const verify2 = crypto.createVerify('DSS1'); - verify2.update(input); - - assert.strictEqual(verify2.verify(dsaPubPem, signature2, 'hex'), true); - } } else { common.printSkipMessage('Skipping unsupported DSA test case'); } diff --git a/test/parallel/test-crypto-rsa-multiprime-jwk.js b/test/parallel/test-crypto-rsa-multiprime-jwk.js index be434c76e82..10b25a90f03 100644 --- a/test/parallel/test-crypto-rsa-multiprime-jwk.js +++ b/test/parallel/test-crypto-rsa-multiprime-jwk.js @@ -6,13 +6,13 @@ if (!common.hasCrypto) const assert = require('assert'); const fixtures = require('../common/fixtures'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const { createPrivateKey, } = require('crypto'); const { subtle } = globalThis.crypto; -if (process.features.openssl_is_boringssl) +if (isBoringSSL) common.skip('multi-prime RSA is not available with BoringSSL'); if (hasFIPS()) common.skip('multi-prime RSA is not available in FIPS mode'); diff --git a/test/parallel/test-crypto-rsa-pss-parameters.js b/test/parallel/test-crypto-rsa-pss-parameters.js index cda01e7a16d..8cc802beec8 100644 --- a/test/parallel/test-crypto-rsa-pss-parameters.js +++ b/test/parallel/test-crypto-rsa-pss-parameters.js @@ -2,9 +2,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3) || isBoringSSL) - common.skip('requires OpenSSL 3 provider support'); +const { isBoringSSL } = require('../common/crypto'); +if (isBoringSSL) + common.skip('requires OpenSSL provider support'); const assert = require('assert'); const fixtures = require('../common/fixtures'); diff --git a/test/parallel/test-crypto-sec-level.js b/test/parallel/test-crypto-sec-level.js index ff32b29bb2b..d4459bc5b75 100644 --- a/test/parallel/test-crypto-sec-level.js +++ b/test/parallel/test-crypto-sec-level.js @@ -13,7 +13,7 @@ const assert = require('assert'); // are available by default. Different OpenSSL versions have different // default security levels and we use this value to adjust what a test // expects based on the security level. You can read more in -// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour +// https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour // This test simply validates that we can get some value for the secLevel // when needed by tests. const secLevel = require('internal/crypto/util').getOpenSSLSecLevel(); diff --git a/test/parallel/test-crypto-secure-heap.js b/test/parallel/test-crypto-secure-heap.js index 22f90b6be99..559879491d6 100644 --- a/test/parallel/test-crypto-secure-heap.js +++ b/test/parallel/test-crypto-secure-heap.js @@ -19,7 +19,6 @@ if (common.hasV8Sandbox) { const { isBoringSSL, - hasOpenSSL, hasFIPS, } = require('../common/crypto'); @@ -33,7 +32,6 @@ const fixtures = require('../common/fixtures'); const { secureHeapUsed, createDiffieHellman, - getFips, } = require('crypto'); if (process.argv[2] === 'child') { @@ -47,8 +45,7 @@ if (process.argv[2] === 'child') { assert.strictEqual(a.used, 0); { - const size = hasFIPS(3) ? - 2048 : (getFips() === 1 || hasOpenSSL(3) ? 1024 : 256); + const size = hasFIPS(3) ? 2048 : 1024; const dh1 = createDiffieHellman(size); const p1 = dh1.getPrime('buffer'); const dh2 = createDiffieHellman(p1, 'buffer'); diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js index 4b874a7e43f..cb02c4ffd33 100644 --- a/test/parallel/test-crypto-sign-verify.js +++ b/test/parallel/test-crypto-sign-verify.js @@ -79,11 +79,9 @@ if (fips30) { key: keyPem, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING }); - }, { message: hasOpenSSL(3) ? - 'error:1C8000A5:Provider routines::illegal or unsupported padding mode' : - isBoringSSL ? - 'error:0600006d:public key routines:OPENSSL_internal:ILLEGAL_OR_UNSUPPORTED_PADDING_MODE' : - 'bye, bye, error stack' }); + }, { message: isBoringSSL ? + 'error:0600006d:public key routines:OPENSSL_internal:ILLEGAL_OR_UNSUPPORTED_PADDING_MODE' : + 'error:1C8000A5:Provider routines::illegal or unsupported padding mode' }); delete Object.prototype.opensslErrorStack; } @@ -374,19 +372,12 @@ assert.throws( key: keyPem, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING }); - }, hasOpenSSL(3) ? { - code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE', - message: /illegal or unsupported padding mode/, - } : isBoringSSL ? { + }, isBoringSSL ? { code: 'ERR_OSSL_EVP_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE', message: /ILLEGAL_OR_UNSUPPORTED_PADDING_MODE/, } : { - code: 'ERR_OSSL_RSA_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE', + code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE', message: /illegal or unsupported padding mode/, - opensslErrorStack: [ - 'error:06089093:digital envelope routines:EVP_PKEY_CTX_ctrl:' + - 'command not supported', - ], }); } @@ -682,7 +673,7 @@ if (hasOpenSSL(3, 2)) { // Preserve the current behavior from https://github.com/nodejs/node/issues/53761: // one-shot verify does not accept SM2 signatures produced by the streaming path. -if (hasOpenSSL(3) && crypto.getHashes().includes('sm3')) { +if (!isBoringSSL && crypto.getHashes().includes('sm3')) { const data = Buffer.from('AABB'); const privateKey = crypto.createPrivateKey(`-----BEGIN PRIVATE KEY----- MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQgbjCNHopgvyGVfLaP diff --git a/test/parallel/test-crypto-stream.js b/test/parallel/test-crypto-stream.js index 9584e48f2cb..8abaf4b8a73 100644 --- a/test/parallel/test-crypto-stream.js +++ b/test/parallel/test-crypto-stream.js @@ -28,7 +28,6 @@ if (!common.hasCrypto) { const assert = require('assert'); const stream = require('stream'); const crypto = require('crypto'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); if (!crypto.getFips()) { // Small stream to buffer converter @@ -73,15 +72,10 @@ const cipher = crypto.createCipheriv('aes-128-cbc', key, iv); const decipher = crypto.createDecipheriv('aes-128-cbc', badkey, iv); cipher.pipe(decipher) - .on('error', common.expectsError((hasOpenSSL(3) || isBoringSSL) ? { + .on('error', common.expectsError({ message: /bad[\s_]decrypt/i, library: /Provider routines|Cipher functions/, reason: /bad[\s_]decrypt/i, - } : { - message: /bad[\s_]decrypt/i, - function: 'EVP_DecryptFinal_ex', - library: 'digital envelope routines', - reason: /bad[\s_]decrypt/i, })); cipher.end('Papaya!'); // Should not cause an unhandled exception. diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js index 1467fd6104d..89525b93370 100644 --- a/test/parallel/test-crypto-x509.js +++ b/test/parallel/test-crypto-x509.js @@ -31,7 +31,7 @@ const ca = readFileSync(fixtures.path('keys', 'ca1-cert.pem')); const privateKey = createPrivateKey(key); if (!isBoringSSL) { - const expectedPubkeys = hasOpenSSL(3) ? [ + const expectedPubkeys = [ [ 'rsa_pss_cert_2048.pem', 292, @@ -42,17 +42,6 @@ if (!isBoringSSL) { 342, 'da0bcd53fbe3969c7cc2730f86abc34e0e1c340264bbdfa3faf01484c2eeece0', ], - ] : [ - [ - 'rsa_pss_cert_2048.pem', - 294, - '4d4f2f076aced4f0df922b84b466b0a60ba4cb50a23d695ae12ddc5fff7aca14', - ], - [ - 'rsa_pss_cert_2048_sha256_sha256_16.pem', - 294, - 'd37942c3bd02bc25c724fcd31efd647824e536c13d62d9ad0b5db8c0900d3cba', - ], ]; for (const [name, length, digest] of expectedPubkeys) { @@ -90,7 +79,7 @@ emailAddress=ry@tinyclouds.org`; let infoAccessCheck = `OCSP - URI:http://ocsp.nodejs.org/ CA Issuers - URI:http://ca.nodejs.org/ca.cert`; -if (!hasOpenSSL(3)) +if (isBoringSSL) infoAccessCheck += '\n'; const der = Buffer.from( @@ -519,7 +508,7 @@ UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0 assert.strictEqual(child.status, 0, child.stderr || child.stdout); assert.throws(() => cert.publicKey, { - message: hasOpenSSL(3) ? /decode error/ : /wrong tag/, + message: /decode error/, name: 'Error' }); diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js index 3e431c788c6..257c405324c 100644 --- a/test/parallel/test-crypto.js +++ b/test/parallel/test-crypto.js @@ -29,7 +29,7 @@ const assert = require('assert'); const crypto = require('crypto'); const tls = require('tls'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const isFips = hasFIPS(3); // Test Certificates @@ -244,25 +244,16 @@ assert.throws(() => { assert(Array.isArray(err.opensslErrorStack)); assert(err.opensslErrorStack.length > 0); } else { - if (!hasOpenSSL(3)) - assert.ok(!('opensslErrorStack' in err)); - assert.throws(() => { throw err; }, hasOpenSSL(3) ? { + assert.throws(() => { throw err; }, { name: 'Error', message: 'error:02000070:rsa routines::digest too big for rsa key', library: 'rsa routines', - } : { - name: 'Error', - message: /routines:RSA_sign:digest too big for rsa key$/, - library: /rsa routines/i, - function: 'RSA_sign', - reason: /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i, - code: 'ERR_OSSL_RSA_DIGEST_TOO_BIG_FOR_RSA_KEY' }); } return true; }); -if (!hasOpenSSL(3)) { +if (isBoringSSL) { // The correct header inside `rsa_private_pkcs8_bad.pem` should have been // -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- // instead of @@ -270,32 +261,10 @@ if (!hasOpenSSL(3)) { const sha1_privateKey = fixtures.readKey('rsa_private_pkcs8_bad.pem', 'ascii'); - if (isBoringSSL) { - // BoringSSL accepts the PKCS#8 payload despite the legacy PEM label. - const signature = crypto.createSign('sha1').sign(sha1_privateKey); - assert(Buffer.isBuffer(signature)); - assert.strictEqual(signature.length, 256); - } else { - assert.throws(() => { - // This would inject errors onto OpenSSL's error stack - crypto.createSign('sha1').sign(sha1_privateKey); - }, (err) => { - // Do the standard checks, but then do some custom checks afterwards. - assert.throws(() => { throw err; }, { - message: 'error:0D0680A8:asn1 encoding routines:asn1_check_tlen:' + - 'wrong tag', - library: 'asn1 encoding routines', - function: 'asn1_check_tlen', - reason: 'wrong tag', - code: 'ERR_OSSL_ASN1_WRONG_TAG', - }); - // Throws crypto error, so there is an opensslErrorStack property. - // The openSSL stack should have content. - assert(Array.isArray(err.opensslErrorStack)); - assert(err.opensslErrorStack.length > 0); - return true; - }); - } + // BoringSSL accepts the PKCS#8 payload despite the legacy PEM label. + const signature = crypto.createSign('sha1').sign(sha1_privateKey); + assert(Buffer.isBuffer(signature)); + assert.strictEqual(signature.length, 256); } // Make sure memory isn't released before being returned diff --git a/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js b/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js index 0d7366dd343..2ad900cbf35 100644 --- a/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js +++ b/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js @@ -26,7 +26,7 @@ const channelName = 'crypto.fips.indicator'; if (!hasOpenSSL(3, 4)) { common.skip('OpenSSL 3.4 or later is required'); } else if (!hasFIPS(3, 4)) { - common.skip('an active OpenSSL 3.4+ FIPS provider is required'); + common.skip('an active OpenSSL FIPS provider is required'); } else if (!process.execArgv.includes('--enable-fips-indicator-events')) { spawnSyncAndExitWithoutError( process.execPath, diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js index c4edc5b33db..cd82fb0cbb7 100644 --- a/test/parallel/test-https-agent-session-eviction.js +++ b/test/parallel/test-https-agent-session-eviction.js @@ -84,7 +84,7 @@ function second(server, session) { // Offering the cached session to a server using another TLS version should // not prevent a fresh connection. req.on('response', common.mustCall(function(res) { - // The test is now complete for OpenSSL 1.1.0. + // The test is now complete. server.close(); })); diff --git a/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js b/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js index ec1b8dda8ca..c9096c570fc 100644 --- a/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js +++ b/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js @@ -12,18 +12,9 @@ const fixtures = require('../common/fixtures'); if (!common.hasCrypto) common.skip('missing crypto'); -const crypto = require('crypto'); -const { hasOpenSSL } = require('../common/crypto'); - -// See #37990 for details on why this is problematic with FIPS. -if (crypto.getFips() === 1 && !hasOpenSSL(3)) - common.skip('Skipping as test uses non-fips compliant EC curve'); - -// This test will fail for OpenSSL < 1.1.1h -const minOpenSSL = 269488271; - -if (crypto.constants.OPENSSL_VERSION_NUMBER < minOpenSSL) - common.skip('OpenSSL < 1.1.1h'); +const { isBoringSSL } = require('../common/crypto'); +if (isBoringSSL) + common.skip('not supported by BoringSSL'); const https = require('https'); const path = require('path'); diff --git a/test/parallel/test-permission-openssl-store.js b/test/parallel/test-permission-openssl-store.js index b1cfcdc4988..b47553a9e88 100644 --- a/test/parallel/test-permission-openssl-store.js +++ b/test/parallel/test-permission-openssl-store.js @@ -4,9 +4,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); -if (!hasOpenSSL(3)) - common.skip('requires OpenSSL 3.x'); +const { isBoringSSL } = require('../common/crypto'); +if (isBoringSSL) + common.skip('OpenSSL provider support is required'); // Verifies the openssl.store permission: allowed when --allow-openssl-store is // set, can be dropped at runtime, and denied by default in a child process. diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js index f5aeec01796..910fec097b6 100644 --- a/test/parallel/test-process-env-allowed-flags-are-documented.js +++ b/test/parallel/test-process-env-allowed-flags-are-documented.js @@ -5,7 +5,7 @@ const common = require('../common'); const assert = require('assert'); const fs = require('fs'); const path = require('path'); -const { hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); const rootDir = path.resolve(__dirname, '..', '..'); const cliMd = path.join(rootDir, 'doc', 'api', 'cli.md'); @@ -44,7 +44,7 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) { } } -if (!hasOpenSSL(3)) { +if (isBoringSSL) { documented.delete('--openssl-legacy-provider'); documented.delete('--openssl-shared-config'); } @@ -63,8 +63,8 @@ const conditionalOpts = [ filter: (opt) => { return [ '--openssl-config', - hasOpenSSL(3) ? '--openssl-legacy-provider' : '', - hasOpenSSL(3) ? '--openssl-shared-config' : '', + isBoringSSL ? '' : '--openssl-legacy-provider', + isBoringSSL ? '' : '--openssl-shared-config', '--tls-cipher-list', '--use-bundled-ca', '--use-openssl-ca', diff --git a/test/parallel/test-process-versions.js b/test/parallel/test-process-versions.js index 420625b01f5..9cb122448ed 100644 --- a/test/parallel/test-process-versions.js +++ b/test/parallel/test-process-versions.js @@ -104,18 +104,14 @@ assert.match( assert.match(process.versions.modules, /^\d+$/); if (common.hasCrypto) { - const { hasOpenSSL } = require('../common/crypto'); assert.match(process.versions.ncrypto, commonTemplate); if (process.config.variables.node_shared_openssl) { assert.ok(process.versions.openssl); } else { - const versionRegex = hasOpenSSL(3) ? - // The following also matches a development version of OpenSSL 3.x which - // can be in the format '3.0.0-alpha4-dev'. This can be handy when - // building and linking against the main development branch of OpenSSL. - /^\d+\.\d+\.\d+(?:[-+][a-z0-9]+)*$/ : - /^\d+\.\d+\.\d+[a-z]?(\+quic)?(-fips)?$/; - assert.match(process.versions.openssl, versionRegex); + // The following also matches a development version of OpenSSL, such as + // '3.0.0-alpha4-dev'. This can be handy when + // building and linking against the main development branch of OpenSSL. + assert.match(process.versions.openssl, /^\d+\.\d+\.\d+(?:[-+][a-z0-9]+)*$/); } } diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js index 1b80571e70e..ee1a77c2aa2 100644 --- a/test/parallel/test-tls-alert-handling.js +++ b/test/parallel/test-tls-alert-handling.js @@ -5,11 +5,6 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { - hasOpenSSL, - isBoringSSL, -} = require('../common/crypto'); - const assert = require('assert'); const net = require('net'); const tls = require('tls'); @@ -39,8 +34,6 @@ const errorHandler = common.mustCall((err) => { assert.match(err.code, /ERR_SSL_(WRONG_VERSION_NUMBER|PACKET_LENGTH_TOO_LONG|BAD_RECORD_TYPE)/); assert.strictEqual(err.library, 'SSL routines'); - if (!hasOpenSSL(3) && !isBoringSSL) - assert.strictEqual(err.function, 'ssl3_get_record'); assert.match(err.reason, /wrong[\s_]version[\s_]number|packet[\s_]length[\s_]too[\s_]long|bad[\s_]record[\s_]type/i); errorReceived = true; @@ -100,8 +93,6 @@ function sendBADTLSRecord() { assert.match(err.code, /ERR_SSL_(TLSV1_ALERT_PROTOCOL_VERSION|TLSV1_ALERT_RECORD_OVERFLOW|(SSL\/)?TLS_ALERT_UNEXPECTED_MESSAGE)/); assert.strictEqual(err.library, 'SSL routines'); - if (!hasOpenSSL(3) && !isBoringSSL) - assert.strictEqual(err.function, 'ssl3_read_bytes'); assert.match(err.reason, /tlsv1[\s_]alert[\s_]protocol[\s_]version|tlsv1[\s_]alert[\s_]record[\s_]overflow|(ssl\/)?tls[\s_]alert[\s_]unexpected[\s_]message/i); })); diff --git a/test/parallel/test-tls-client-mindhsize.js b/test/parallel/test-tls-client-mindhsize.js index f08be448dd1..c15ab7e28ee 100644 --- a/test/parallel/test-tls-client-mindhsize.js +++ b/test/parallel/test-tls-client-mindhsize.js @@ -8,7 +8,7 @@ if (!common.hasCrypto) // are available by default. Different OpenSSL versions have different // default security levels and we use this value to adjust what a test // expects based on the security level. You can read more in -// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour +// https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour const secLevel = require('internal/crypto/util').getOpenSSLSecLevel(); const assert = require('assert'); const tls = require('tls'); diff --git a/test/parallel/test-tls-client-renegotiation-13.js b/test/parallel/test-tls-client-renegotiation-13.js index 33e74af13ed..b69ddd126e5 100644 --- a/test/parallel/test-tls-client-renegotiation-13.js +++ b/test/parallel/test-tls-client-renegotiation-13.js @@ -5,7 +5,7 @@ const common = require('../common'); if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); const fixtures = require('../common/fixtures'); @@ -40,9 +40,7 @@ connect({ }); } else { assert.throws(() => { throw err; }, { - message: hasOpenSSL(3) ? - 'error:0A00010A:SSL routines::wrong ssl version' : - 'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version', + message: 'error:0A00010A:SSL routines::wrong ssl version', code: 'ERR_SSL_WRONG_SSL_VERSION', library: 'SSL routines', reason: 'wrong ssl version', diff --git a/test/parallel/test-tls-dhe.js b/test/parallel/test-tls-dhe.js index 6f54bbd9766..cad14df5529 100644 --- a/test/parallel/test-tls-dhe.js +++ b/test/parallel/test-tls-dhe.js @@ -43,7 +43,7 @@ const { // are available by default. Different OpenSSL versions have different // default security levels and we use this value to adjust what a test // expects based on the security level. You can read more in -// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour +// https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour const secLevel = require('internal/crypto/util').getOpenSSLSecLevel(); if (!opensslCli) { @@ -67,7 +67,7 @@ const ciphers = `${dheCipher}:${ecdheCipher}`; if (secLevel < 2 && !hasFIPS(3)) { // Test will emit a warning because the DH parameter size is < 2048 bits - // when the test is run on versions lower than OpenSSL32 + // when the test is run on OpenSSL versions earlier than 3.2 common.expectWarning('SecurityWarning', 'DH parameter is less than 2048 bits'); } diff --git a/test/parallel/test-tls-junk-closes-server.js b/test/parallel/test-tls-junk-closes-server.js index 08c2d39c684..a90fbc60c9b 100644 --- a/test/parallel/test-tls-junk-closes-server.js +++ b/test/parallel/test-tls-junk-closes-server.js @@ -42,7 +42,7 @@ server.listen(0, common.mustCall(function() { c.on('data', function() { // We must consume all data sent by the server. Otherwise the // end event will not be sent and the test will hang. - // For example, when compiled with OpenSSL32 we see the + // For example, when compiled with OpenSSL 3.2 we see the // following response '15 03 03 00 02 02 16' which // decodes as a fatal (0x02) TLS error alert number 22 (0x16), // which corresponds to TLS1_AD_RECORD_OVERFLOW which matches @@ -51,7 +51,7 @@ server.listen(0, common.mustCall(function() { // but the TLS spec seems to indicate there should be one // https://datatracker.ietf.org/doc/html/rfc8446#page-85 // and error handling seems to have been re-written/improved - // in OpenSSL32. Consuming the data allows the test to pass + // in OpenSSL 3.2. Consuming the data allows the test to pass // either way. }); diff --git a/test/parallel/test-tls-key-mismatch.js b/test/parallel/test-tls-key-mismatch.js index 8f60ef0520c..fa26419fe5b 100644 --- a/test/parallel/test-tls-key-mismatch.js +++ b/test/parallel/test-tls-key-mismatch.js @@ -27,15 +27,13 @@ if (!common.hasCrypto) { } const fixtures = require('../common/fixtures'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const tls = require('tls'); const errorMessageRegex = isBoringSSL ? /^Error: error:0b000074:X\.509 certificate routines:OPENSSL_internal:KEY_VALUES_MISMATCH$/ : - hasOpenSSL(3) ? - /^Error: error:05800074:x509 certificate routines::key values mismatch$/ : - /^Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch$/; + /^Error: error:05800074:x509 certificate routines::key values mismatch$/; const options = { key: fixtures.readKey('agent1-key.pem'), diff --git a/test/parallel/test-tls-legacy-pfx.js b/test/parallel/test-tls-legacy-pfx.js index 77f9c093502..2f3339196f4 100644 --- a/test/parallel/test-tls-legacy-pfx.js +++ b/test/parallel/test-tls-legacy-pfx.js @@ -4,10 +4,10 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3)) { - common.skip('OpenSSL legacy failures are only testable with OpenSSL 3+'); +if (isBoringSSL) { + common.skip('OpenSSL legacy failures are not testable with BoringSSL'); } const fixtures = require('../common/fixtures'); diff --git a/test/parallel/test-tls-min-max-version.js b/test/parallel/test-tls-min-max-version.js index 3f91d946c23..ca5698f5181 100644 --- a/test/parallel/test-tls-min-max-version.js +++ b/test/parallel/test-tls-min-max-version.js @@ -43,9 +43,9 @@ function test(cmin, cmax, cprot, smin, smax, sprot, proto, cerr, serr) { } let ciphers; - if (hasOpenSSL(3) && (proto === 'TLSv1' || proto === 'TLSv1.1' || - proto === 'TLSv1_1_method' || proto === 'TLSv1_method' || - sprot === 'TLSv1_1_method' || sprot === 'TLSv1_method')) { + if (!isBoringSSL && (proto === 'TLSv1' || proto === 'TLSv1.1' || + proto === 'TLSv1_1_method' || proto === 'TLSv1_method' || + sprot === 'TLSv1_1_method' || sprot === 'TLSv1_method')) { if (serr !== 'ERR_SSL_UNSUPPORTED_PROTOCOL') ciphers = 'ALL@SECLEVEL=0'; } @@ -179,15 +179,11 @@ for (const [method, version] of [ test(U, U, 'TLS_method', U, U, method, ...expected); } -// OpenSSL 1.1.1 and 3.0 use a different error code and alert (sent to the -// client) when no protocols are enabled on the server. // BoringSSL closes the connection without sending an alert in this case. const NO_PROTOCOLS_AVAILABLE_SERVER = isBoringSSL ? - 'ERR_SSL_NO_SUPPORTED_VERSIONS_ENABLED' : hasOpenSSL(3) ? - 'ERR_SSL_NO_PROTOCOLS_AVAILABLE' : 'ERR_SSL_INTERNAL_ERROR'; + 'ERR_SSL_NO_SUPPORTED_VERSIONS_ENABLED' : 'ERR_SSL_NO_PROTOCOLS_AVAILABLE'; const NO_PROTOCOLS_AVAILABLE_SERVER_ALERT = isBoringSSL ? - 'ECONNRESET' : hasOpenSSL(3) ? - 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION' : 'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR'; + 'ECONNRESET' : 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION'; const NO_PROTOCOLS_AVAILABLE_CLIENT = isBoringSSL ? 'ERR_SSL_NO_SUPPORTED_VERSIONS_ENABLED' : 'ERR_SSL_NO_PROTOCOLS_AVAILABLE'; const NO_PROTOCOLS_AVAILABLE_CLIENT_ALERT = isBoringSSL ? diff --git a/test/parallel/test-tls-set-ciphers.js b/test/parallel/test-tls-set-ciphers.js index 0562c808b8d..6fb071092da 100644 --- a/test/parallel/test-tls-set-ciphers.js +++ b/test/parallel/test-tls-set-ciphers.js @@ -1,7 +1,7 @@ 'use strict'; const common = require('../common'); if (!common.hasCrypto) { - common.skip('missing crypto, or OpenSSL version lower than 3'); + common.skip('missing crypto'); } const { @@ -10,10 +10,6 @@ const { isBoringSSL, } = require('../common/crypto'); -if (!hasOpenSSL(3) && !isBoringSSL) { - common.skip('missing crypto, or OpenSSL version lower than 3'); -} - const fixtures = require('../common/fixtures'); const { inspect } = require('util'); @@ -154,7 +150,7 @@ if (hasFIPS(3)) { // TLS_AES_128_CCM_8_SHA256 & TLS_AES_128_CCM_SHA256 are not enabled by // default, but work. - // However, for OpenSSL32 AES_128 is not enabled due to the + // However, for OpenSSL 3.2 AES_128 is not enabled due to the // default security level if (isBoringSSL) { // BoringSSL does not implement the TLS 1.3 CCM cipher suites. diff --git a/test/parallel/test-tls13-ciphers.js b/test/parallel/test-tls13-ciphers.js index 7cf87557e8d..af4cebafbb6 100644 --- a/test/parallel/test-tls13-ciphers.js +++ b/test/parallel/test-tls13-ciphers.js @@ -7,7 +7,7 @@ const assert = require('assert'); const { constants } = require('crypto'); const tls = require('tls'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); const { spawnSyncAndAssert } = require('../common/child_process'); const { connect, keys } = require(fixtures.path('tls-connect')); @@ -90,16 +90,10 @@ test(aes128, aes256, undefined); const duplicates = `${aes256} \t:${aes256}`; test(duplicates, duplicates, aes256); -// OpenSSL 1.1.1 rejects unknown TLS 1.3 cipher names. OpenSSL 3 and BoringSSL -// ignore them and do not interpret exclusion rules in the TLS 1.3 list. +// Unknown TLS 1.3 cipher names are ignored, and exclusion rules are not +// interpreted in the TLS 1.3 list. const list = `TLS_UNKNOWN:!${aes128}:${duplicates}`; -if (hasOpenSSL(3) || isBoringSSL) { - test(list, list, aes256); -} else { - assert.throws(() => tls.createSecureContext({ ciphers: list }), { - code: 'ERR_SSL_NO_CIPHER_MATCH', - }); -} +test(list, list, aes256); for (const ciphers of ['TLS_UNKNOWN', `!${aes128}`]) { assert.throws(() => tls.createSecureContext({ ciphers }), { code: 'ERR_SSL_NO_CIPHER_MATCH', diff --git a/test/parallel/test-trace-env.js b/test/parallel/test-trace-env.js index 4d1a8165277..6c3d144f8ab 100644 --- a/test/parallel/test-trace-env.js +++ b/test/parallel/test-trace-env.js @@ -19,8 +19,8 @@ spawnSyncAndAssert(process.execPath, ['--trace-env', fixtures.path('empty.js')], if (common.hasCrypto) { assert.match(output, /get "NODE_EXTRA_CA_CERTS"/); - const { hasOpenSSL } = require('../common/crypto'); - if (hasOpenSSL(3)) { + const { isBoringSSL } = require('../common/crypto'); + if (!isBoringSSL) { assert.match(output, /get "OPENSSL_CONF"/); } } diff --git a/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js b/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js index 53db81496b2..7df489b48df 100644 --- a/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js +++ b/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js @@ -6,7 +6,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const { subtle } = globalThis.crypto; const fips3 = hasFIPS(3); @@ -56,7 +56,7 @@ if (fips3) { tests.push(test('ChaCha20-Poly1305', 32, 12, 'raw-secret')); } -if (hasOpenSSL(3)) { +if (!isBoringSSL) { tests.push(test( 'AES-OCB', 32, diff --git a/test/parallel/test-webcrypto-deduplicate-usages.js b/test/parallel/test-webcrypto-deduplicate-usages.js index 4ef6cbd8d9b..1a1ff8da94b 100644 --- a/test/parallel/test-webcrypto-deduplicate-usages.js +++ b/test/parallel/test-webcrypto-deduplicate-usages.js @@ -54,7 +54,7 @@ function assertSameSet(actual, expected, msg) { symmetric.splice(symmetric.findIndex(({ algorithm }) => algorithm.name === 'ChaCha20-Poly1305'), 1); - if (hasOpenSSL(3)) { + if (!isBoringSSL) { symmetric.push({ algorithm: { name: 'AES-OCB', length: 128 }, usages: ['decrypt', 'encrypt', 'decrypt', 'encrypt'], @@ -66,7 +66,7 @@ function assertSameSet(actual, expected, msg) { expected: ['sign', 'verify'], }); } else { - common.printSkipMessage('AES-OCB and KMAC require OpenSSL >= 3'); + common.printSkipMessage('AES-OCB and KMAC are not supported by BoringSSL'); } for (const { algorithm, usages, expected } of symmetric) { @@ -178,7 +178,7 @@ function assertSameSet(actual, expected, msg) { expected: ['wrapKey', 'unwrapKey'] }, ]; - if (hasOpenSSL(3)) { + if (!isBoringSSL) { // KMAC does not support `raw` format, only `raw-secret` and `jwk`. tests.push((async () => { const key = await subtle.importKey( @@ -203,7 +203,7 @@ function assertSameSet(actual, expected, msg) { assert.strictEqual(key.usages.length, 2); })()); } else { - common.printSkipMessage('AES-OCB and KMAC require OpenSSL >= 3'); + common.printSkipMessage('AES-OCB and KMAC are not supported by BoringSSL'); } for (const { algorithm, keyData, usages, expected } of rawSymmetric) { @@ -374,7 +374,7 @@ function assertSameSet(actual, expected, msg) { })()); // AES-OCB raw-secret import. - if (hasOpenSSL(3)) { + if (!isBoringSSL) { tests.push((async () => { const imported = subtle.importKey( 'raw-secret', @@ -393,7 +393,7 @@ function assertSameSet(actual, expected, msg) { assert.strictEqual(key.usages.length, 2); })()); } else { - common.printSkipMessage('AES-OCB requires OpenSSL >= 3'); + common.printSkipMessage('AES-OCB is not supported by BoringSSL'); } Promise.all(tests).then(common.mustCall()); @@ -469,7 +469,7 @@ function assertSameSet(actual, expected, msg) { expected: ['wrapKey', 'unwrapKey'] }, ]; - if (hasOpenSSL(3)) { + if (!isBoringSSL) { jwkVectors.push({ algorithm: { name: 'AES-OCB', length: 128 }, usages: ['decrypt', 'encrypt', 'decrypt', 'encrypt'], @@ -481,7 +481,7 @@ function assertSameSet(actual, expected, msg) { expected: ['sign', 'verify'], }); } else { - common.printSkipMessage('AES-OCB and KMAC require OpenSSL >= 3'); + common.printSkipMessage('AES-OCB and KMAC are not supported by BoringSSL'); } for (const { algorithm, usages, expected } of jwkVectors) { diff --git a/test/parallel/test-webcrypto-derivebits-hkdf.js b/test/parallel/test-webcrypto-derivebits-hkdf.js index 4fbaa1d7c64..a723b425f07 100644 --- a/test/parallel/test-webcrypto-derivebits-hkdf.js +++ b/test/parallel/test-webcrypto-derivebits-hkdf.js @@ -6,7 +6,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); -const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const { subtle } = globalThis.crypto; function getDeriveKeyInfo(name, length, hash, ...usages) { @@ -38,13 +38,13 @@ if (!isBoringSSL) { common.printSkipMessage('SHA-3 is only supported for digest operations'); } -if (hasOpenSSL(3)) { +if (!isBoringSSL) { kDerivedKeyTypes.push( ['AES-OCB', 128, undefined, 'encrypt', 'decrypt'], ['AES-OCB', 256, undefined, 'encrypt', 'decrypt'], ); } else { - common.printSkipMessage('Skipping unsupported test cases'); + common.printSkipMessage('Skipping AES-OCB test cases unsupported by BoringSSL'); } const kDerivedKeys = { diff --git a/test/parallel/test-webcrypto-derivekey.js b/test/parallel/test-webcrypto-derivekey.js index a4acb112c6b..49966b5ef80 100644 --- a/test/parallel/test-webcrypto-derivekey.js +++ b/test/parallel/test-webcrypto-derivekey.js @@ -6,7 +6,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { subtle } = globalThis.crypto; @@ -191,7 +191,7 @@ const fips4 = hasFIPS(4); common.printSkipMessage('SHA-3 is only supported for digest operations'); } - if (hasOpenSSL(3)) { + if (!isBoringSSL) { vectors.push( ['KMAC128', 'sign', 128], [{ name: 'KMAC128', length: 384 }, 'sign', 384], @@ -251,7 +251,7 @@ const fips4 = hasFIPS(4); common.printSkipMessage('SHA-3 is only supported for digest operations'); } - if (hasOpenSSL(3)) { + if (!isBoringSSL) { vectors.push( ['KMAC128', 'sign', 128], [{ name: 'KMAC128', length: 384 }, 'sign', 384], @@ -284,7 +284,7 @@ const fips4 = hasFIPS(4); })().then(common.mustCall()); } -if (hasOpenSSL(3)) { +if (!isBoringSSL) { (async () => { const derivedKeyAlgorithm = { name: 'KMAC128', length: 0 }; const usages = ['sign']; diff --git a/test/parallel/test-webcrypto-encrypt-decrypt-aes.js b/test/parallel/test-webcrypto-encrypt-decrypt-aes.js index bdf1a1d6666..0789f71cdd7 100644 --- a/test/parallel/test-webcrypto-encrypt-decrypt-aes.js +++ b/test/parallel/test-webcrypto-encrypt-decrypt-aes.js @@ -5,7 +5,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { getFips } = require('crypto'); @@ -230,7 +230,7 @@ async function testDecrypt({ keyBuffer, algorithm, result }) { } // Test aes-ocb vectors -if (hasOpenSSL(3)) { +if (!isBoringSSL) { const { passing, failing, diff --git a/test/parallel/test-webcrypto-encrypt-decrypt.js b/test/parallel/test-webcrypto-encrypt-decrypt.js index 45d0aa64f72..f68dd404336 100644 --- a/test/parallel/test-webcrypto-encrypt-decrypt.js +++ b/test/parallel/test-webcrypto-encrypt-decrypt.js @@ -6,7 +6,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); const { getFips } = require('crypto'); const { subtle } = globalThis.crypto; @@ -148,7 +148,7 @@ async function testRSAOaep(publicKey, privateKey) { } // Test Encrypt/Decrypt AES-OCB -if (hasOpenSSL(3)) { +if (!isBoringSSL) { const buf = globalThis.crypto.getRandomValues(new Uint8Array(50)); const iv = globalThis.crypto.getRandomValues(new Uint8Array(12)); @@ -180,5 +180,5 @@ if (hasOpenSSL(3)) { test().then(common.mustCall()); } } else { - common.printSkipMessage('Skipping unsupported AES-OCB test cases'); + common.printSkipMessage('Skipping AES-OCB test cases unsupported by BoringSSL'); } diff --git a/test/parallel/test-webcrypto-export-import.js b/test/parallel/test-webcrypto-export-import.js index 4578f7d587d..ad30a5d510e 100644 --- a/test/parallel/test-webcrypto-export-import.js +++ b/test/parallel/test-webcrypto-export-import.js @@ -6,7 +6,7 @@ const fixtures = require('../common/fixtures'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { subtle } = globalThis.crypto; @@ -221,7 +221,7 @@ const { } // Import/Export KMAC Secret Key -if (hasOpenSSL(3)) { +if (!isBoringSSL) { async function test(name) { const keyData = globalThis.crypto.getRandomValues(new Uint8Array(32)); const key = await subtle.importKey( diff --git a/test/parallel/test-webcrypto-keygen-kmac.js b/test/parallel/test-webcrypto-keygen-kmac.js index 999e70df6a6..b51363b79ce 100644 --- a/test/parallel/test-webcrypto-keygen-kmac.js +++ b/test/parallel/test-webcrypto-keygen-kmac.js @@ -5,10 +5,10 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3)) - common.skip('requires OpenSSL >= 3'); +if (isBoringSSL) + common.skip('KMAC is not supported by BoringSSL'); const assert = require('assert'); const { types: { isCryptoKey } } = require('util'); diff --git a/test/parallel/test-webcrypto-keygen.js b/test/parallel/test-webcrypto-keygen.js index 6618a43db74..9d484f1c3b5 100644 --- a/test/parallel/test-webcrypto-keygen.js +++ b/test/parallel/test-webcrypto-keygen.js @@ -177,7 +177,7 @@ if (!isBoringSSL) { common.printSkipMessage('Skipping unsupported test cases'); } -if (hasOpenSSL(3)) { +if (!isBoringSSL) { vectors['AES-OCB'] = { algorithm: { length: 256 }, result: 'CryptoKey', diff --git a/test/parallel/test-webcrypto-kmac-empty-output.js b/test/parallel/test-webcrypto-kmac-empty-output.js index fe88f7ab769..a1783ec64d4 100644 --- a/test/parallel/test-webcrypto-kmac-empty-output.js +++ b/test/parallel/test-webcrypto-kmac-empty-output.js @@ -5,10 +5,10 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasFIPS, hasOpenSSL } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3)) - common.skip('requires OpenSSL >= 3'); +if (isBoringSSL) + common.skip('KMAC is not supported by BoringSSL'); if (hasFIPS()) common.skip('empty KMAC output is not supported in FIPS mode'); diff --git a/test/parallel/test-webcrypto-sign-verify-kmac.js b/test/parallel/test-webcrypto-sign-verify-kmac.js index 5829ab3685c..312431b4f06 100644 --- a/test/parallel/test-webcrypto-sign-verify-kmac.js +++ b/test/parallel/test-webcrypto-sign-verify-kmac.js @@ -5,10 +5,10 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3)) - common.skip('requires OpenSSL >= 3'); +if (isBoringSSL) + common.skip('KMAC is not supported by BoringSSL'); const assert = require('assert'); const { subtle } = globalThis.crypto; diff --git a/test/parallel/test-webcrypto-sign-verify.js b/test/parallel/test-webcrypto-sign-verify.js index 295f1378238..70148ee28ae 100644 --- a/test/parallel/test-webcrypto-sign-verify.js +++ b/test/parallel/test-webcrypto-sign-verify.js @@ -109,7 +109,7 @@ const { subtle } = globalThis.crypto; } // Test Sign/Verify KMAC -if (hasOpenSSL(3)) { +if (!isBoringSSL) { async function test(name, data) { const ec = new TextEncoder(); diff --git a/test/parallel/test-webcrypto-supports-fips.js b/test/parallel/test-webcrypto-supports-fips.js index e08551c65f3..470c776933e 100644 --- a/test/parallel/test-webcrypto-supports-fips.js +++ b/test/parallel/test-webcrypto-supports-fips.js @@ -3,8 +3,8 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3) || isBoringSSL) common.skip('requires OpenSSL 3'); +const { isBoringSSL } = require('../common/crypto'); +if (isBoringSSL) common.skip('requires an OpenSSL provider'); const assert = require('node:assert'); const crypto = require('node:crypto'); diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js index 84024462204..5abc9fb06db 100644 --- a/test/parallel/test-webcrypto-wrap-unwrap.js +++ b/test/parallel/test-webcrypto-wrap-unwrap.js @@ -60,7 +60,7 @@ const kWrappingData = { if (fips3) delete kWrappingData['ChaCha20-Poly1305']; -if (hasOpenSSL(3) && !fips3) { +if (!isBoringSSL && !fips3) { kWrappingData['AES-OCB'] = { generate: { length: 128 }, wrap: { @@ -484,7 +484,7 @@ async function testNonByteLengthWrapUnwrap({ implicitAlgorithm: hmacAlgorithm, }); - if (hasOpenSSL(3) && getFips() !== 1) { + if (!isBoringSSL && getFips() !== 1) { for (const name of ['KMAC128', 'KMAC256']) { const keyData = new Uint8Array(32).fill(0xff); const kmacKey = await subtle.importKey( diff --git a/test/parallel/test-x509-escaping.js b/test/parallel/test-x509-escaping.js index daa51e28191..c48b846e905 100644 --- a/test/parallel/test-x509-escaping.js +++ b/test/parallel/test-x509-escaping.js @@ -59,8 +59,8 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); 'IP Address:8.8.8.8', 'IP Address:8.8.4.4', // For backward-compatibility, include invalid IP address lengths. - hasOpenSSL(3) ? 'IP Address:' : 'IP Address:', - hasOpenSSL(3) ? 'IP Address:' : 'IP Address:', + isBoringSSL ? 'IP Address:' : 'IP Address:', + isBoringSSL ? 'IP Address:' : 'IP Address:', // IPv6 addresses are represented as OpenSSL does. 'IP Address:A0B:C0D:E0F:0:0:0:7A7B:7C7D', // Regular email addresses don't require escaping. @@ -88,22 +88,22 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); // This is an OID that will likely never be assigned to anything, thus // OpenSSL should not know it. 'Registered ID:1.3.9999.12.34', - hasOpenSSL(3) ? + !isBoringSSL ? 'othername:XmppAddr:abc123' : 'othername:', - hasOpenSSL(3) ? + !isBoringSSL ? 'othername:"XmppAddr:abc123\\u002c DNS:good.example.com"' : 'othername:', - hasOpenSSL(3) ? + !isBoringSSL ? 'othername:"XmppAddr:good.example.com\\u0000abc123"' : 'othername:', // This is unsupported because the OID is not recognized. 'othername:', - hasOpenSSL(3) ? 'othername:SRVName:abc123' : 'othername:', + isBoringSSL ? 'othername:' : 'othername:SRVName:abc123', // This is unsupported because it is an SRVName with a UTF8String value, // which is not allowed for SRVName. 'othername:', - hasOpenSSL(3) ? + !isBoringSSL ? 'othername:"SRVName:abc\\u0000def"' : 'othername:', ]; @@ -173,7 +173,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); ], }, }, - hasOpenSSL(3) ? { + !isBoringSSL ? { text: 'OCSP - othername:XmppAddr:good.example.com\n' + 'OCSP - othername:\n' + 'OCSP - othername:SRVName:abc123', @@ -196,7 +196,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); ], }, }, - hasOpenSSL(3) ? { + !isBoringSSL ? { text: 'OCSP - othername:"XmppAddr:good.example.com\\u0000abc123"', legacy: { 'OCSP - othername': [ @@ -222,7 +222,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); // Test the subjectAltName property of the X509Certificate API. const cert = new X509Certificate(pem); assert.strictEqual(cert.infoAccess, - `${expected.text}${hasOpenSSL(3) ? '' : '\n'}`); + `${expected.text}${isBoringSSL ? '\n' : ''}`); // Test that the certificate obtained by checkServerIdentity has the correct // subjectaltname property. diff --git a/test/pummel/test-crypto-dh-hash.js b/test/pummel/test-crypto-dh-hash.js index e428df491a3..f61fd5bf3ea 100644 --- a/test/pummel/test-crypto-dh-hash.js +++ b/test/pummel/test-crypto-dh-hash.js @@ -30,10 +30,10 @@ if (common.isPi()) { common.skip('Too slow for Raspberry Pi devices'); } -const { hasOpenSSL } = require('../common/crypto'); +const { isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3)) { - common.skip('Too slow when dynamically linked against OpenSSL 1.1.1'); +if (isBoringSSL) { + common.skip('BoringSSL does not support all tested MODP groups'); } const assert = require('assert'); diff --git a/test/pummel/test-dh-regr.js b/test/pummel/test-dh-regr.js index 8a2e71745a3..b5a1995ffef 100644 --- a/test/pummel/test-dh-regr.js +++ b/test/pummel/test-dh-regr.js @@ -32,7 +32,7 @@ if (common.isPi()) { const assert = require('assert'); const crypto = require('crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); let iterations = 2000; if (hasFIPS(3)) { @@ -46,11 +46,11 @@ if (hasFIPS(3)) { } let createDH; -if (hasOpenSSL(3)) { - // OpenSSL 3 recognizes named groups without validating their primes. +if (!isBoringSSL) { + // OpenSSL recognizes named groups without validating their primes. createDH = () => crypto.getDiffieHellman('modp14'); } else { - // Other backends validate each peer's parameters, so keep them small. + // BoringSSL validates each peer's parameters, so keep them small. const length = crypto.getFips() === 1 ? 1024 : 256; const prime = crypto.createDiffieHellman(length).getPrime(); createDH = () => crypto.createDiffieHellman(prime); diff --git a/test/wpt/status/WebCryptoAPI.cjs b/test/wpt/status/WebCryptoAPI.cjs index 4e8e4efd882..be5ee9c9e54 100644 --- a/test/wpt/status/WebCryptoAPI.cjs +++ b/test/wpt/status/WebCryptoAPI.cjs @@ -30,7 +30,7 @@ function skipSubtests(...entries) { } } -if (!hasOpenSSL(3, 0)) { +if (isBoringSSL) { skip( 'modern-algos/encrypt_decrypt/aes_ocb.https.any.js', 'modern-algos/generateKey/failures_AES-OCB.https.any.js',