API tools faq
paste
Guest User

nodejs-20.11.1-libressl-3.8.4.patch

a guest
May 5th, 2024
59
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 29.71 KB | None | 0 0
raw download clone embed print report
  1. diff --git a/lib/_tls_common.js b/lib/_tls_common.js
  2. index 16c6a647cc..8fa771d3fa 100644
  3. --- a/lib/_tls_common.js
  4. +++ b/lib/_tls_common.js
  5. @@ -71,6 +71,11 @@ const {
  6. SecureContext: NativeSecureContext,
  7. } = internalBinding('crypto');
  8.  
  9. +const {
  10. + isLibreSSL,
  11. +} = process.versions.openssl &&
  12. + /LibreSSL$/.test(process.versions.openssl);
  13. +
  14. function SecureContext(secureProtocol, secureOptions, minVersion, maxVersion) {
  15. if (!(this instanceof SecureContext)) {
  16. return new SecureContext(secureProtocol, secureOptions, minVersion,
  17. diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
  18. index 5950c52c1d..945b1f4a4e 100644
  19. --- a/lib/_tls_wrap.js
  20. +++ b/lib/_tls_wrap.js
  21. @@ -116,6 +116,9 @@ const kIsVerified = Symbol('verified');
  22.  
  23. const noop = FunctionPrototype;
  24.  
  25. +const isLibreSSL = process.versions.openssl &&
  26. + /LibreSSL$/.test(process.versions.openssl);
  27. +
  28. let ipServernameWarned = false;
  29. let tlsTracingWarned = false;
  30.  
  31. @@ -190,7 +193,11 @@ function loadSession(hello) {
  32.  
  33. owner._handle.loadSession(session);
  34. // Session is loaded. End the parser to allow handshaking to continue.
  35. - owner._handle.endParser();
  36. + if (isLibreSSL) {
  37. + oncertcb(hello, owner, session && session.servername || hello.servername);
  38. + } else {
  39. + owner._handle.endParser();
  40. + }
  41. }
  42.  
  43. if (hello.sessionId.length <= 0 ||
  44. @@ -207,9 +214,12 @@ function loadSession(hello) {
  45. }
  46.  
  47.  
  48. -function loadSNI(info) {
  49. - const owner = this[owner_symbol];
  50. - const servername = info.servername;
  51. +function loadSNI(info, owner, servername) {
  52. + if (!owner)
  53. + owner = this[owner_symbol];
  54. + if (!servername)
  55. + servername = info.servername;
  56. +
  57. if (!servername || !owner._SNICallback)
  58. return requestOCSP(owner, info);
  59.  
  60. @@ -285,11 +295,15 @@ function requestOCSP(socket, info) {
  61.  
  62. function requestOCSPDone(socket) {
  63. debug('server certcb done');
  64. - try {
  65. - socket._handle.certCbDone();
  66. - } catch (e) {
  67. - debug('server certcb done errored', e);
  68. - socket.destroy(e);
  69. + if (isLibreSSL) {
  70. + socket._handle.endParser();
  71. + } else {
  72. + try {
  73. + socket._handle.certCbDone();
  74. + } catch (e) {
  75. + debug('server certcb done errored', e);
  76. + socket.destroy(e);
  77. + }
  78. }
  79. }
  80.  
  81. @@ -1556,13 +1570,15 @@ function onConnectSecure() {
  82.  
  83. // Check the size of DHE parameter above minimum requirement
  84. // specified in options.
  85. - const ekeyinfo = this.getEphemeralKeyInfo();
  86. - if (ekeyinfo.type === 'DH' && ekeyinfo.size < options.minDHSize) {
  87. - const err = new ERR_TLS_DH_PARAM_SIZE(ekeyinfo.size);
  88. - debug('client emit:', err);
  89. - this.emit('error', err);
  90. - this.destroy();
  91. - return;
  92. + if (!isLibreSSL) {
  93. + const ekeyinfo = this.getEphemeralKeyInfo();
  94. + if (ekeyinfo.type === 'DH' && ekeyinfo.size < options.minDHSize) {
  95. + const err = new ERR_TLS_DH_PARAM_SIZE(ekeyinfo.size);
  96. + debug('client emit:', err);
  97. + this.emit('error', err);
  98. + this.destroy();
  99. + return;
  100. + }
  101. }
  102.  
  103. let verifyError = this._handle.verifyError();
  104. diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
  105. index 2e6e02d229..a69d827711 100644
  106. --- a/src/crypto/crypto_cipher.cc
  107. +++ b/src/crypto/crypto_cipher.cc
  108. @@ -30,7 +30,7 @@ bool IsSupportedAuthenticatedMode(const EVP_CIPHER* cipher) {
  109. switch (EVP_CIPHER_mode(cipher)) {
  110. case EVP_CIPH_CCM_MODE:
  111. case EVP_CIPH_GCM_MODE:
  112. -#ifndef OPENSSL_NO_OCB
  113. +#if !( defined(OPENSSL_NO_OCB) || defined(LIBRESSL_VERSION_NUMBER) )
  114. case EVP_CIPH_OCB_MODE:
  115. #endif
  116. return true;
  117. @@ -82,7 +82,9 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
  118. case EVP_CIPH_CTR_MODE: mode_label = "ctr"; break;
  119. case EVP_CIPH_ECB_MODE: mode_label = "ecb"; break;
  120. case EVP_CIPH_GCM_MODE: mode_label = "gcm"; break;
  121. +#if !( defined(OPENSSL_NO_OCB) || defined(LIBRESSL_VERSION_NUMBER) )
  122. case EVP_CIPH_OCB_MODE: mode_label = "ocb"; break;
  123. +#endif
  124. case EVP_CIPH_OFB_MODE: mode_label = "ofb"; break;
  125. case EVP_CIPH_WRAP_MODE: mode_label = "wrap"; break;
  126. case EVP_CIPH_XTS_MODE: mode_label = "xts"; break;
  127. @@ -122,6 +124,7 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
  128. break;
  129. case EVP_CIPH_GCM_MODE:
  130. // Fall through
  131. +#if !( defined(OPENSSL_NO_OCB) || defined(LIBRESSL_VERSION_NUMBER) )
  132. case EVP_CIPH_OCB_MODE:
  133. if (!EVP_CIPHER_CTX_ctrl(
  134. ctx.get(),
  135. @@ -131,6 +134,7 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
  136. return;
  137. }
  138. break;
  139. +#endif
  140. default:
  141. if (check_len != iv_length)
  142. return;
  143. diff --git a/src/crypto/crypto_common.cc b/src/crypto/crypto_common.cc
  144. index 41e607e929..bea3a05d01 100644
  145. --- a/src/crypto/crypto_common.cc
  146. +++ b/src/crypto/crypto_common.cc
  147. @@ -126,12 +126,17 @@ long VerifyPeerCertificate( // NOLINT(runtime/int)
  148. X509_free(peer_cert);
  149. err = SSL_get_verify_result(ssl.get());
  150. } else {
  151. +#ifndef OPENSSL_NO_PSK
  152. const SSL_CIPHER* curr_cipher = SSL_get_current_cipher(ssl.get());
  153. +#endif
  154. const SSL_SESSION* sess = SSL_get_session(ssl.get());
  155. // Allow no-cert for PSK authentication in TLS1.2 and lower.
  156. // In TLS1.3 check that session was reused because TLS1.3 PSK
  157. // looks like session resumption.
  158. - if (SSL_CIPHER_get_auth_nid(curr_cipher) == NID_auth_psk ||
  159. + if (
  160. +#ifndef OPENSSL_NO_PSK
  161. + SSL_CIPHER_get_auth_nid(curr_cipher) == NID_auth_psk ||
  162. +#endif
  163. (SSL_SESSION_get_protocol_version(sess) == TLS1_3_VERSION &&
  164. SSL_session_reused(ssl.get()))) {
  165. return X509_V_OK;
  166. @@ -155,6 +160,9 @@ bool UseSNIContext(
  167. }
  168.  
  169. const char* GetClientHelloALPN(const SSLPointer& ssl) {
  170. +#ifdef LIBRESSL_VERSION_NUMBER
  171. + return nullptr;
  172. +#else
  173. const unsigned char* buf;
  174. size_t len;
  175. size_t rem;
  176. @@ -171,9 +179,13 @@ const char* GetClientHelloALPN(const SSLPointer& ssl) {
  177. len = (buf[0] << 8) | buf[1];
  178. if (len + 2 != rem) return nullptr;
  179. return reinterpret_cast<const char*>(buf + 3);
  180. +#endif
  181. }
  182.  
  183. const char* GetClientHelloServerName(const SSLPointer& ssl) {
  184. +#ifdef LIBRESSL_VERSION_NUMBER
  185. + return nullptr;
  186. +#else
  187. const unsigned char* buf;
  188. size_t len;
  189. size_t rem;
  190. @@ -199,6 +211,7 @@ const char* GetClientHelloServerName(const SSLPointer& ssl) {
  191. if (len + 2 > rem)
  192. return nullptr;
  193. return reinterpret_cast<const char*>(buf + 5);
  194. +#endif
  195. }
  196.  
  197. const char* GetServerName(SSL* ssl) {
  198. @@ -311,7 +324,9 @@ MaybeLocal<Value> GetCipherValue(Environment* env, const SSL_CIPHER* cipher) {
  199. }
  200.  
  201. constexpr auto GetCipherName = GetCipherValue<SSL_CIPHER_get_name>;
  202. +#ifndef LIBRESSL_VERSION_NUMBER
  203. constexpr auto GetCipherStandardName = GetCipherValue<SSL_CIPHER_standard_name>;
  204. +#endif
  205. constexpr auto GetCipherVersion = GetCipherValue<SSL_CIPHER_get_version>;
  206.  
  207. StackOfX509 CloneSSLCerts(X509Pointer&& cert,
  208. @@ -1048,6 +1063,9 @@ MaybeLocal<Array> GetClientHelloCiphers(
  209. Environment* env,
  210. const SSLPointer& ssl) {
  211. EscapableHandleScope scope(env->isolate());
  212. +#ifdef LIBRESSL_VERSION_NUMBER
  213. + return MaybeLocal<Array>();
  214. +#else
  215. const unsigned char* buf;
  216. size_t len = SSL_client_hello_get0_ciphers(ssl.get(), &buf);
  217. size_t count = len / 2;
  218. @@ -1075,6 +1093,7 @@ MaybeLocal<Array> GetClientHelloCiphers(
  219. }
  220. Local<Array> ret = Array::New(env->isolate(), ciphers.out(), count);
  221. return scope.Escape(ret);
  222. +#endif
  223. }
  224.  
  225.  
  226. @@ -1088,10 +1107,12 @@ MaybeLocal<Object> GetCipherInfo(Environment* env, const SSLPointer& ssl) {
  227. info,
  228. env->name_string(),
  229. GetCurrentCipherValue<GetCipherName>(env, ssl)) ||
  230. +#ifndef LIBRESSL_VERSION_NUMBER
  231. !Set<Value>(env->context(),
  232. info,
  233. env->standard_name_string(),
  234. GetCurrentCipherValue<GetCipherStandardName>(env, ssl)) ||
  235. +#endif
  236. !Set<Value>(env->context(),
  237. info,
  238. env->version_string(),
  239. diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
  240. index 36b59eb4d5..c850f1bbf4 100644
  241. --- a/src/crypto/crypto_context.cc
  242. +++ b/src/crypto/crypto_context.cc
  243. @@ -63,7 +63,11 @@ inline X509_STORE* GetOrCreateRootCertStore() {
  244. // Caller responsible for BIO_free_all-ing the returned object.
  245. BIOPointer LoadBIO(Environment* env, Local<Value> v) {
  246. if (v->IsString() || v->IsArrayBufferView()) {
  247. +#ifdef LIBRESSL_VERSION_NUMBER
  248. + BIOPointer bio(BIO_new(BIO_s_mem()));
  249. +#else
  250. BIOPointer bio(BIO_new(BIO_s_secmem()));
  251. +#endif
  252. if (!bio) return nullptr;
  253. ByteSource bsrc = ByteSource::FromStringOrBuffer(env, v);
  254. if (bsrc.size() > INT_MAX) return nullptr;
  255. @@ -625,6 +629,7 @@ void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {
  256. }
  257.  
  258. void SecureContext::SetSigalgs(const FunctionCallbackInfo<Value>& args) {
  259. +#ifndef LIBRESSL_VERSION_NUMBER
  260. SecureContext* sc;
  261. ASSIGN_OR_RETURN_UNWRAP(&sc, args.Holder());
  262. Environment* env = sc->env();
  263. @@ -637,6 +642,7 @@ void SecureContext::SetSigalgs(const FunctionCallbackInfo<Value>& args) {
  264.  
  265. if (!SSL_CTX_set1_sigalgs_list(sc->ctx_.get(), *sigalgs))
  266. return ThrowCryptoError(env, ERR_get_error());
  267. +#endif
  268. }
  269.  
  270. #ifndef OPENSSL_NO_ENGINE
  271. diff --git a/src/crypto/crypto_dsa.cc b/src/crypto/crypto_dsa.cc
  272. index 3fa4a415dc..78f4d2be52 100644
  273. --- a/src/crypto/crypto_dsa.cc
  274. +++ b/src/crypto/crypto_dsa.cc
  275. @@ -13,7 +13,7 @@
  276. #include <cstdio>
  277.  
  278. // EVP_PKEY_CTX_set_dsa_paramgen_q_bits was added in OpenSSL 1.1.1e.
  279. -#if OPENSSL_VERSION_NUMBER < 0x1010105fL
  280. +#if OPENSSL_VERSION_NUMBER < 0x1010105fL || defined(LIBRESSL_VERSION_NUMBER)
  281. #define EVP_PKEY_CTX_set_dsa_paramgen_q_bits(ctx, qbits) \
  282. EVP_PKEY_CTX_ctrl((ctx), \
  283. EVP_PKEY_DSA, \
  284. diff --git a/src/crypto/crypto_ec.cc b/src/crypto/crypto_ec.cc
  285. index 415464be04..2d4fa57655 100644
  286. --- a/src/crypto/crypto_ec.cc
  287. +++ b/src/crypto/crypto_ec.cc
  288. @@ -516,7 +516,11 @@ bool ECDHBitsTraits::DeriveBits(Environment* env,
  289. break;
  290. }
  291. default: {
  292. +#ifdef LIBRESSL_VERSION_NUMBER
  293. + EC_KEY* private_key;
  294. +#else
  295. const EC_KEY* private_key;
  296. +#endif
  297. {
  298. Mutex::ScopedLock priv_lock(*m_privkey.mutex());
  299. private_key = EVP_PKEY_get0_EC_KEY(m_privkey.get());
  300. @@ -636,6 +640,9 @@ WebCryptoKeyExportStatus EC_Raw_Export(
  301. size_t len = 0;
  302.  
  303. if (ec_key == nullptr) {
  304. +#ifdef LIBRESSL_VERSION_NUMBER
  305. + return WebCryptoKeyExportStatus::FAILED;
  306. +#else
  307. typedef int (*export_fn)(const EVP_PKEY*, unsigned char*, size_t* len);
  308. export_fn fn = nullptr;
  309. switch (key_data->GetKeyType()) {
  310. @@ -656,6 +663,7 @@ WebCryptoKeyExportStatus EC_Raw_Export(
  311. if (fn(m_pkey.get(), data.data<unsigned char>(), &len) == 0)
  312. return WebCryptoKeyExportStatus::INVALID_KEY_TYPE;
  313. *out = std::move(data).release(len);
  314. +#endif
  315. } else {
  316. if (key_data->GetKeyType() != kKeyTypePublic)
  317. return WebCryptoKeyExportStatus::INVALID_KEY_TYPE;
  318. @@ -872,7 +880,9 @@ Maybe<bool> ExportJWKEdKey(
  319. OneByteString(env->isolate(), curve)).IsNothing()) {
  320. return Nothing<bool>();
  321. }
  322. -
  323. +#ifdef LIBRESSL_VERSION_NUMBER
  324. + return Nothing<bool>();
  325. +#else
  326. size_t len = 0;
  327. Local<Value> encoded;
  328. Local<Value> error;
  329. @@ -905,7 +915,7 @@ Maybe<bool> ExportJWKEdKey(
  330. env->isolate()->ThrowException(error);
  331. return Nothing<bool>();
  332. }
  333. -
  334. +#endif
  335. if (target->Set(
  336. env->context(),
  337. env->jwk_kty_string(),
  338. diff --git a/src/crypto/crypto_hash.cc b/src/crypto/crypto_hash.cc
  339. index 5627bac590..414db4a960 100644
  340. --- a/src/crypto/crypto_hash.cc
  341. +++ b/src/crypto/crypto_hash.cc
  342. @@ -119,12 +119,14 @@ bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
  343.  
  344. md_len_ = EVP_MD_size(md);
  345. if (xof_md_len.IsJust() && xof_md_len.FromJust() != md_len_) {
  346. +#ifndef LIBRESSL_VERSION_NUMBER
  347. // This is a little hack to cause createHash to fail when an incorrect
  348. // hashSize option was passed for a non-XOF hash function.
  349. if ((EVP_MD_flags(md) & EVP_MD_FLAG_XOF) == 0) {
  350. EVPerr(EVP_F_EVP_DIGESTFINALXOF, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
  351. return false;
  352. }
  353. +#endif
  354. md_len_ = xof_md_len.FromJust();
  355. }
  356.  
  357. @@ -183,8 +185,12 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
  358. // The output length should always equal hash->md_len_
  359. CHECK_EQ(len, hash->md_len_);
  360. } else {
  361. +#ifdef LIBRESSL_VERSION_NUMBER
  362. + ret = 0;
  363. +#else
  364. ret = EVP_DigestFinalXOF(
  365. hash->mdctx_.get(), digest.data<unsigned char>(), len);
  366. +#endif
  367. }
  368.  
  369. if (ret != 1)
  370. @@ -264,12 +270,14 @@ Maybe<bool> HashTraits::AdditionalConfig(
  371. params->length =
  372. static_cast<uint32_t>(args[offset + 2]
  373. .As<Uint32>()->Value()) / CHAR_BIT;
  374. +#ifndef LIBRESSL_VERSION_NUMBER
  375. if (params->length != expected) {
  376. if ((EVP_MD_flags(params->digest) & EVP_MD_FLAG_XOF) == 0) {
  377. THROW_ERR_CRYPTO_INVALID_DIGEST(env, "Digest method not supported");
  378. return Nothing<bool>();
  379. }
  380. }
  381. +#endif
  382. }
  383.  
  384. return Just(true);
  385. @@ -297,7 +305,11 @@ bool HashTraits::DeriveBits(
  386. int ret =
  387. (length == expected)
  388. ? EVP_DigestFinal_ex(ctx.get(), buf.data<unsigned char>(), &length)
  389. +#ifdef LIBRESSL_VERSION_NUMBER
  390. + : 0;
  391. +#else
  392. : EVP_DigestFinalXOF(ctx.get(), buf.data<unsigned char>(), length);
  393. +#endif
  394.  
  395. if (UNLIKELY(ret != 1))
  396. return false;
  397. diff --git a/src/crypto/crypto_hkdf.cc b/src/crypto/crypto_hkdf.cc
  398. index 7663dd6937..d6a78accf4 100644
  399. --- a/src/crypto/crypto_hkdf.cc
  400. +++ b/src/crypto/crypto_hkdf.cc
  401. @@ -104,6 +104,9 @@ bool HKDFTraits::DeriveBits(
  402. Environment* env,
  403. const HKDFConfig& params,
  404. ByteSource* out) {
  405. +#ifdef LIBRESSL_VERSION_NUMBER
  406. + return false;
  407. +#else
  408. EVPKeyCtxPointer ctx =
  409. EVPKeyCtxPointer(EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, nullptr));
  410. if (!ctx || !EVP_PKEY_derive_init(ctx.get()) ||
  411. @@ -152,6 +155,7 @@ bool HKDFTraits::DeriveBits(
  412.  
  413. *out = std::move(buf).release();
  414. return true;
  415. +#endif
  416. }
  417.  
  418. void HKDFConfig::MemoryInfo(MemoryTracker* tracker) const {
  419. diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
  420. index 1b8e9b25a6..dd3fed311d 100644
  421. --- a/src/crypto/crypto_keys.cc
  422. +++ b/src/crypto/crypto_keys.cc
  423. @@ -595,15 +595,23 @@ void ManagedEVPPKey::MemoryInfo(MemoryTracker* tracker) const {
  424. }
  425.  
  426. size_t ManagedEVPPKey::size_of_private_key() const {
  427. +#ifdef LIBRESSL_VERSION_NUMBER
  428. + return 0;
  429. +#else
  430. size_t len = 0;
  431. return (pkey_ && EVP_PKEY_get_raw_private_key(
  432. pkey_.get(), nullptr, &len) == 1) ? len : 0;
  433. +#endif
  434. }
  435.  
  436. size_t ManagedEVPPKey::size_of_public_key() const {
  437. +#ifdef LIBRESSL_VERSION_NUMBER
  438. + return 0;
  439. +#else
  440. size_t len = 0;
  441. return (pkey_ && EVP_PKEY_get_raw_public_key(
  442. pkey_.get(), nullptr, &len) == 1) ? len : 0;
  443. +#endif
  444. }
  445.  
  446. // This maps true to Just<bool>(true) and false to Nothing<bool>().
  447. @@ -1087,6 +1095,9 @@ void KeyObjectHandle::InitECRaw(const FunctionCallbackInfo<Value>& args) {
  448. }
  449.  
  450. void KeyObjectHandle::InitEDRaw(const FunctionCallbackInfo<Value>& args) {
  451. +#ifdef LIBRESSL_VERSION_NUMBER
  452. + args.GetReturnValue().Set(false);
  453. +#else
  454. Environment* env = Environment::GetCurrent(args);
  455. KeyObjectHandle* key;
  456. ASSIGN_OR_RETURN_UNWRAP(&key, args.Holder());
  457. @@ -1126,6 +1137,7 @@ void KeyObjectHandle::InitEDRaw(const FunctionCallbackInfo<Value>& args) {
  458. }
  459.  
  460. args.GetReturnValue().Set(true);
  461. +#endif
  462. }
  463.  
  464. void KeyObjectHandle::Equals(const FunctionCallbackInfo<Value>& args) {
  465. diff --git a/src/crypto/crypto_random.cc b/src/crypto/crypto_random.cc
  466. index 9850104cd6..b37bd47e92 100644
  467. --- a/src/crypto/crypto_random.cc
  468. +++ b/src/crypto/crypto_random.cc
  469. @@ -140,7 +140,11 @@ Maybe<bool> RandomPrimeTraits::AdditionalConfig(
  470.  
  471. params->bits = bits;
  472. params->safe = safe;
  473. +#ifdef LIBRESSL_VERSION_NUMBER
  474. + params->prime.reset(BN_new());
  475. +#else
  476. params->prime.reset(BN_secure_new());
  477. +#endif
  478. if (!params->prime) {
  479. THROW_ERR_CRYPTO_OPERATION_FAILED(env, "could not generate prime");
  480. return Nothing<bool>();
  481. diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
  482. index 47a42246ed..92fae3a1db 100644
  483. --- a/src/crypto/crypto_rsa.cc
  484. +++ b/src/crypto/crypto_rsa.cc
  485. @@ -610,10 +610,14 @@ Maybe<bool> GetRsaKeyDetail(
  486. }
  487.  
  488. if (params->saltLength != nullptr) {
  489. +#ifdef LIBRESSL_VERSION_NUMBER
  490. + return Nothing<bool>();
  491. +#else
  492. if (ASN1_INTEGER_get_int64(&salt_length, params->saltLength) != 1) {
  493. ThrowCryptoError(env, ERR_get_error(), "ASN1_INTEGER_get_in64 error");
  494. return Nothing<bool>();
  495. }
  496. +#endif
  497. }
  498.  
  499. if (target
  500. diff --git a/src/crypto/crypto_scrypt.cc b/src/crypto/crypto_scrypt.cc
  501. index 4dae07f136..00731dae9e 100644
  502. --- a/src/crypto/crypto_scrypt.cc
  503. +++ b/src/crypto/crypto_scrypt.cc
  504. @@ -18,7 +18,7 @@ using v8::Uint32;
  505. using v8::Value;
  506.  
  507. namespace crypto {
  508. -#ifndef OPENSSL_NO_SCRYPT
  509. +#if !( defined(OPENSSL_NO_SCRYPT) || defined(LIBRESSL_VERSION_NUMBER) )
  510.  
  511. ScryptConfig::ScryptConfig(ScryptConfig&& other) noexcept
  512. : mode(other.mode),
  513. @@ -138,7 +138,7 @@ bool ScryptTraits::DeriveBits(
  514. return true;
  515. }
  516.  
  517. -#endif // !OPENSSL_NO_SCRYPT
  518. +#endif // !(OPENSSL_NO_SCRYPT || LIBRESSL_VERSION_NUMBER)
  519.  
  520. } // namespace crypto
  521. } // namespace node
  522. diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
  523. index cc2f6d60e7..ad5f98daae 100644
  524. --- a/src/crypto/crypto_tls.cc
  525. +++ b/src/crypto/crypto_tls.cc
  526. @@ -417,7 +417,9 @@ void TLSWrap::InitSSL() {
  527.  
  528. ConfigureSecureContext(sc_.get());
  529.  
  530. +#ifndef LIBRESSL_VERSION_NUMBER
  531. SSL_set_cert_cb(ssl_.get(), SSLCertCallback, this);
  532. +#endif
  533.  
  534. if (is_server()) {
  535. SSL_set_accept_state(ssl_.get());
  536. @@ -1292,6 +1294,9 @@ int TLSWrap::SelectSNIContextCallback(SSL* s, int* ad, void* arg) {
  537. }
  538.  
  539. int TLSWrap::SetCACerts(SecureContext* sc) {
  540. +#ifdef LIBRESSL_VERSION_NUMBER
  541. + return 0;
  542. +#else
  543. int err = SSL_set1_verify_cert_store(ssl_.get(),
  544. SSL_CTX_get_cert_store(sc->ctx().get()));
  545. if (err != 1)
  546. @@ -1303,6 +1308,7 @@ int TLSWrap::SetCACerts(SecureContext* sc) {
  547. // NOTE: `SSL_set_client_CA_list` takes the ownership of `list`
  548. SSL_set_client_CA_list(ssl_.get(), list);
  549. return 1;
  550. +#endif
  551. }
  552.  
  553. #ifndef OPENSSL_NO_PSK
  554. @@ -1744,7 +1750,11 @@ void TLSWrap::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
  555. TLSWrap* w;
  556. ASSIGN_OR_RETURN_UNWRAP(&w, args.Holder());
  557.  
  558. +#ifdef LIBRESSL_VERSION_NUMBER
  559. + MaybeStackBuffer<Local<Value>, 16> ret_arr(0);
  560. +#else
  561. SSL* ssl = w->ssl_.get();
  562. +
  563. int nsig = SSL_get_shared_sigalgs(ssl, 0, nullptr, nullptr, nullptr, nullptr,
  564. nullptr);
  565. MaybeStackBuffer<Local<Value>, 16> ret_arr(nsig);
  566. @@ -1785,7 +1795,6 @@ void TLSWrap::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
  567. case NID_id_GostR3410_2001:
  568. sig_with_md = "gost2001+";
  569. break;
  570. -
  571. case NID_id_GostR3410_2012_256:
  572. sig_with_md = "gost2012_256+";
  573. break;
  574. @@ -1813,7 +1822,7 @@ void TLSWrap::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
  575. }
  576. ret_arr[i] = OneByteString(env->isolate(), sig_with_md.c_str());
  577. }
  578. -
  579. +#endif
  580. args.GetReturnValue().Set(
  581. Array::New(env->isolate(), ret_arr.out(), ret_arr.length()));
  582. }
  583. @@ -1876,6 +1885,9 @@ void TLSWrap::Renegotiate(const FunctionCallbackInfo<Value>& args) {
  584. }
  585.  
  586. void TLSWrap::GetTLSTicket(const FunctionCallbackInfo<Value>& args) {
  587. +#ifdef LIBRESSL_VERSION_NUMBER
  588. + return;
  589. +#else
  590. TLSWrap* w;
  591. ASSIGN_OR_RETURN_UNWRAP(&w, args.Holder());
  592. Environment* env = w->env();
  593. @@ -1893,6 +1905,7 @@ void TLSWrap::GetTLSTicket(const FunctionCallbackInfo<Value>& args) {
  594. Buffer::Copy(env, reinterpret_cast<const char*>(ticket), length)
  595. .FromMaybe(Local<Object>()));
  596. }
  597. +#endif
  598. }
  599.  
  600. void TLSWrap::NewSessionDone(const FunctionCallbackInfo<Value>& args) {
  601. diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
  602. index 9b1d7acfc4..997f500466 100644
  603. --- a/src/crypto/crypto_util.cc
  604. +++ b/src/crypto/crypto_util.cc
  605. @@ -155,7 +155,7 @@ static Mutex fips_mutex;
  606. void InitCryptoOnce() {
  607. Mutex::ScopedLock lock(per_process::cli_options_mutex);
  608. Mutex::ScopedLock fips_lock(fips_mutex);
  609. -#ifndef OPENSSL_IS_BORINGSSL
  610. +#if !( defined(OPENSSL_IS_BORINGSSL) || defined(LIBRESSL_VERSION_NUMBER) )
  611. OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
  612.  
  613. #if OPENSSL_VERSION_MAJOR < 3
  614. @@ -199,7 +199,7 @@ void InitCryptoOnce() {
  615. }
  616. #endif
  617.  
  618. -#endif // OPENSSL_IS_BORINGSSL
  619. +#endif // OPENSSL_IS_BORINGSSL || LIBRESSL_VERSION_NUMBER
  620.  
  621. // Turn off compression. Saves memory and protects against CRIME attacks.
  622. // No-op with OPENSSL_NO_COMP builds of OpenSSL.
  623. @@ -498,6 +498,43 @@ Maybe<bool> Decorate(Environment* env, Local<Object> obj,
  624. c = ToUpper(c);
  625. }
  626.  
  627. +#ifdef LIBRESSL_VERSION_NUMBER
  628. +#define OSSL_ERROR_CODES_MAP(V) \
  629. + V(SYS) \
  630. + V(BN) \
  631. + V(RSA) \
  632. + V(DH) \
  633. + V(EVP) \
  634. + V(BUF) \
  635. + V(OBJ) \
  636. + V(PEM) \
  637. + V(DSA) \
  638. + V(X509) \
  639. + V(ASN1) \
  640. + V(CONF) \
  641. + V(CRYPTO) \
  642. + V(EC) \
  643. + V(SSL) \
  644. + V(BIO) \
  645. + V(PKCS7) \
  646. + V(X509V3) \
  647. + V(PKCS12) \
  648. + V(RAND) \
  649. + V(DSO) \
  650. + V(ENGINE) \
  651. + V(OCSP) \
  652. + V(UI) \
  653. + V(COMP) \
  654. + V(ECDSA) \
  655. + V(ECDH) \
  656. + V(FIPS) \
  657. + V(CMS) \
  658. + V(TS) \
  659. + V(HMAC) \
  660. + V(CT) \
  661. + V(USER) \
  662. +
  663. +#else
  664. #define OSSL_ERROR_CODES_MAP(V) \
  665. V(SYS) \
  666. V(BN) \
  667. @@ -537,6 +574,8 @@ Maybe<bool> Decorate(Environment* env, Local<Object> obj,
  668. V(SM2) \
  669. V(USER) \
  670.  
  671. +#endif
  672. +
  673. #define V(name) case ERR_LIB_##name: lib = #name "_"; break;
  674. const char* lib = "";
  675. const char* prefix = "OSSL_";
  676. @@ -708,7 +747,13 @@ void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
  677. CHECK(args[0]->IsUint32());
  678. Environment* env = Environment::GetCurrent(args);
  679. uint32_t len = args[0].As<Uint32>()->Value();
  680. +#ifdef LIBRESSL_VERSION_NUMBER
  681. + void* data = OPENSSL_malloc(len);
  682. + if (data != nullptr)
  683. + memset(data, 0, len);
  684. +#else
  685. void* data = OPENSSL_secure_zalloc(len);
  686. +#endif
  687. if (data == nullptr) {
  688. // There's no memory available for the allocation.
  689. // Return nothing.
  690. @@ -727,10 +772,12 @@ void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
  691. }
  692.  
  693. void SecureHeapUsed(const FunctionCallbackInfo<Value>& args) {
  694. +#ifndef LIBRESSL_VERSION_NUMBER
  695. Environment* env = Environment::GetCurrent(args);
  696. if (CRYPTO_secure_malloc_initialized())
  697. args.GetReturnValue().Set(
  698. BigInt::New(env->isolate(), CRYPTO_secure_used()));
  699. +#endif
  700. }
  701. } // namespace
  702.  
  703. diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
  704. index bf19334cf6..8e180938aa 100644
  705. --- a/src/crypto/crypto_util.h
  706. +++ b/src/crypto/crypto_util.h
  707. @@ -37,6 +37,26 @@
  708. #include <string>
  709. #include <vector>
  710.  
  711. +#ifdef LIBRESSL_VERSION_NUMBER
  712. +# define OPENSSL_memdup(str, s)
  713. +# define BUF_memdup(str, s)
  714. +# define NID_ED25519 NID_Ed25519
  715. +# define NID_ED448 NID_Ed448
  716. +# define EVP_PKEY_X25519 NID_X25519
  717. +# define EVP_PKEY_ED25519 NID_ED25519
  718. +# define EVP_PKEY_X448 NID_X448
  719. +# define EVP_PKEY_ED448 NID_ED448
  720. +
  721. +inline void OPENSSL_clear_free(void *str, size_t num) {
  722. + if (str) {
  723. + if (num)
  724. + OPENSSL_cleanse(str, num);
  725. + OPENSSL_free(str);
  726. + }
  727. +}
  728. +# define OPENSSL_secure_clear_free OPENSSL_clear_free
  729. +#endif
  730. +
  731. namespace node {
  732. namespace crypto {
  733. // Currently known sizes of commonly used OpenSSL struct sizes.
  734. diff --git a/src/node.cc b/src/node.cc
  735. index b29dc57d60..8ca45cbe9e 100644
  736. --- a/src/node.cc
  737. +++ b/src/node.cc
  738. @@ -947,7 +947,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
  739. }
  740.  
  741. if (!(flags & ProcessInitializationFlags::kNoInitOpenSSL)) {
  742. -#if HAVE_OPENSSL && !defined(OPENSSL_IS_BORINGSSL)
  743. +#if HAVE_OPENSSL && !(defined(OPENSSL_IS_BORINGSSL) || defined(LIBRESSL_VERSION_NUMBER))
  744. auto GetOpenSSLErrorString = []() -> std::string {
  745. std::string ret;
  746. ERR_print_errors_cb(
  747. diff --git a/src/node_crypto.cc b/src/node_crypto.cc
  748. index a94ef62d2c..68f8d045ee 100644
  749. --- a/src/node_crypto.cc
  750. +++ b/src/node_crypto.cc
  751. @@ -59,7 +59,7 @@ namespace crypto {
  752. V(Verify) \
  753. V(X509Certificate)
  754.  
  755. -#ifdef OPENSSL_NO_SCRYPT
  756. +#if defined(OPENSSL_NO_SCRYPT) || defined(LIBRESSL_VERSION_NUMBER)
  757. #define SCRYPT_NAMESPACE_LIST(V)
  758. #else
  759. #define SCRYPT_NAMESPACE_LIST(V) V(ScryptJob)
  760. diff --git a/src/node_metadata.cc b/src/node_metadata.cc
  761. index 22546e9de2..e9337828e7 100644
  762. --- a/src/node_metadata.cc
  763. +++ b/src/node_metadata.cc
  764. @@ -50,7 +50,11 @@ static inline std::string GetOpenSSLVersion() {
  765. // sample openssl version string format
  766. // for reference: "OpenSSL 1.1.0i 14 Aug 2018"
  767. constexpr size_t start = search(OPENSSL_VERSION_TEXT, ' ') + 1;
  768. +#ifdef LIBRESSL_VERSION_NUMBER
  769. + constexpr size_t len = search(&OPENSSL_VERSION_TEXT[start], '\0');
  770. +#else
  771. constexpr size_t len = search(&OPENSSL_VERSION_TEXT[start], ' ');
  772. +#endif
  773. return std::string(OPENSSL_VERSION_TEXT, start, len);
  774. }
  775. #endif // HAVE_OPENSSL
  776.  
  777. --- a/src/crypto/crypto_util.cc 2024-03-30 22:40:54.354491888 +0000
  778. +++ b/src/crypto/crypto_util.cc 2024-03-30 22:41:25.017826016 +0000
  779. @@ -18,7 +18,6 @@
  780. #endif
  781.  
  782. #include <openssl/rand.h>
  783. -
  784. namespace node {
  785.  
  786. using v8::ArrayBuffer;
  787. @@ -43,6 +42,7 @@
  788. using v8::Value;
  789.  
  790. namespace crypto {
  791. +
  792. int VerifyCallback(int preverify_ok, X509_STORE_CTX* ctx) {
  793. // From https://www.openssl.org/docs/man1.1.1/man3/SSL_verify_cb:
  794. //
  795. @@ -723,14 +723,13 @@
  796. }
  797.  
  798. bool SetRsaOaepLabel(const EVPKeyCtxPointer& ctx, const ByteSource& label) {
  799. - if (label.size() != 0) {
  800. - // OpenSSL takes ownership of the label, so we need to create a copy.
  801. - void* label_copy = OPENSSL_memdup(label.data(), label.size());
  802. + if (label.size() != 0) {
  803. + void* label_copy = OPENSSL_realloc(label.data(), label.size());
  804. CHECK_NOT_NULL(label_copy);
  805. int ret = EVP_PKEY_CTX_set0_rsa_oaep_label(
  806. - ctx.get(), static_cast<unsigned char*>(label_copy), label.size());
  807. + ctx.get(), static_cast<unsigned char *>(label_copy), label.size());
  808. if (ret <= 0) {
  809. - OPENSSL_free(label_copy);
  810. + OPENSSL_free(label_copy);
  811. return false;
  812. }
  813. }
  814.  
  815. --- a/src/crypto/crypto_util.h 2024-03-30 22:40:54.354491888 +0000
  816. +++ b/src/crypto/crypto_util.h 2024-03-30 22:43:07.474495305 +0000
  817. @@ -38,15 +38,13 @@
  818. #include <vector>
  819.  
  820. #ifdef LIBRESSL_VERSION_NUMBER
  821. -# define OPENSSL_memdup(str, s)
  822. -# define BUF_memdup(str, s)
  823. # define NID_ED25519 NID_Ed25519
  824. # define NID_ED448 NID_Ed448
  825. # define EVP_PKEY_X25519 NID_X25519
  826. # define EVP_PKEY_ED25519 NID_ED25519
  827. # define EVP_PKEY_X448 NID_X448
  828. # define EVP_PKEY_ED448 NID_ED448
  829. -
  830. +void OPENSSL_free(void *ptr);
  831. inline void OPENSSL_clear_free(void *str, size_t num) {
  832. if (str) {
  833. if (num)
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!