mirror of
https://github.com/nodejs/node.git
synced 2026-10-28 10:15:07 +08:00
Filip Skokan
db7cc5b400
This separates the native crypto backend paths for OpenSSL >= 3, BoringSSL, and legacy OpenSSL. The OpenSSL >= 3 path now builds with `OPENSSL_API_COMPAT=30000` and `OPENSSL_NO_DEPRECATED`, moving normal crypto/TLS code away from APIs that OpenSSL 3.0.0 marks deprecated. BoringSSL remains on its own branch, and OpenSSL < 3 remains the legacy fallback. The exception is ENGINE support. ENGINE APIs are isolated into a dedicated compatibility target so they can remain available while the JS-facing engine APIs are runtime-deprecated in 27.x. That gives us a clear removal point for 28.x, without letting ENGINE usage leak back into the strict OpenSSL 3 path. The split also makes the eventual OpenSSL 1.1.1 removal easier to reason about. Once support for OpenSSL < 3 is dropped, the legacy branch can be removed in a focused follow-up, possibly targeting 27.x, instead of untangling mixed version guards throughout the crypto implementation. No public crypto or TLS API behavior is intentionally changed. Assisted-by: Codex:gpt-5 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: https://github.com/nodejs/node/pull/64211 Refs: https://github.com/nodejs/node/issues/56733 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: James M Snell <jasnell@gmail.com>
55 lines
1.2 KiB
JavaScript
55 lines
1.2 KiB
JavaScript
'use strict';
|
|
const common = require('../common');
|
|
|
|
// Verify connection with explicitly created client SecureContext.
|
|
|
|
const fixtures = require('../common/fixtures');
|
|
const {
|
|
connect, keys, tls
|
|
} = require(fixtures.path('tls-connect'));
|
|
|
|
connect({
|
|
client: {
|
|
servername: 'agent1',
|
|
secureContext: tls.createSecureContext({
|
|
ca: keys.agent1.ca,
|
|
}),
|
|
},
|
|
server: {
|
|
cert: keys.agent1.cert,
|
|
key: keys.agent1.key,
|
|
},
|
|
}, common.mustSucceed((pair, cleanup) => {
|
|
return cleanup();
|
|
}));
|
|
|
|
// Invalid dhparam input is silently discarded for compatibility.
|
|
tls.createSecureContext({ dhparam: fixtures.readKey('ec-key.pem') });
|
|
|
|
connect({
|
|
client: {
|
|
servername: 'agent1',
|
|
secureContext: tls.createSecureContext({
|
|
ca: keys.agent1.ca,
|
|
ciphers: null,
|
|
clientCertEngine: null,
|
|
crl: null,
|
|
dhparam: null,
|
|
passphrase: null,
|
|
pfx: null,
|
|
privateKeyIdentifier: null,
|
|
privateKeyEngine: null,
|
|
sessionIdContext: null,
|
|
sessionTimeout: null,
|
|
sigalgs: null,
|
|
ticketKeys: null,
|
|
}),
|
|
},
|
|
server: {
|
|
cert: keys.agent1.cert,
|
|
key: keys.agent1.key,
|
|
},
|
|
}, common.mustSucceed((pair, cleanup) => {
|
|
return cleanup();
|
|
}));
|