From 4df0beaab03f511b65c1745bfc335ec53ff0160f Mon Sep 17 00:00:00 2001 From: Filip Skokan Date: Thu, 3 Sep 2026 14:31:34 +0200 Subject: [PATCH] test,benchmark: use OpenSSL feature helpers Add isBoringSSL to the test crypto helpers and use it in tests and benchmarks. Replace hasOpenSSL3 call sites with hasOpenSSL(3). Assisted-by: Codex Signed-off-by: Filip Skokan --- benchmark/crypto/create-keyobject.js | 4 +-- benchmark/crypto/kem.js | 4 +-- benchmark/crypto/mac.js | 4 +-- benchmark/crypto/oneshot-sign.js | 4 +-- benchmark/crypto/oneshot-verify.js | 4 +-- test/addons/openssl-providers/providers.cjs | 4 +-- test/common/crypto.js | 3 ++ test/fixtures/crypto/ecdsa.js | 10 ++++--- test/fixtures/crypto/eddsa.js | 4 ++- test/fixtures/crypto/hmac.js | 6 ++-- test/fixtures/crypto/rsa_pkcs.js | 6 ++-- test/fixtures/crypto/rsa_pss.js | 6 ++-- test/fixtures/webcrypto/supports-level-2.mjs | 2 -- .../webcrypto/supports-modern-algorithms.mjs | 4 +-- .../webcrypto/supports-secure-curves.mjs | 4 +-- test/fixtures/webcrypto/supports-sha3.mjs | 4 ++- test/parallel/test-cli-node-options.js | 4 +-- test/parallel/test-config-json-schema.js | 4 +-- .../parallel/test-crypto-async-sign-verify.js | 6 ++-- test/parallel/test-crypto-authenticated.js | 10 +++---- .../test-crypto-boringssl-evp-list.js | 4 ++- test/parallel/test-crypto-certificate.js | 6 ++-- test/parallel/test-crypto-dh-curves.js | 8 +++--- test/parallel/test-crypto-dh-errors.js | 4 +-- test/parallel/test-crypto-dh-group-setters.js | 4 ++- test/parallel/test-crypto-dh-modp2-views.js | 4 +-- test/parallel/test-crypto-dh-modp2.js | 4 +-- test/parallel/test-crypto-dh-stateless.js | 7 +++-- test/parallel/test-crypto-dh.js | 5 ++-- test/parallel/test-crypto-ecb.js | 4 +-- test/parallel/test-crypto-eddsa-variants.js | 3 +- test/parallel/test-crypto-encap-decap.js | 8 ++++-- .../test-crypto-fips-indicator-strict.js | 9 ++++-- test/parallel/test-crypto-fips.js | 15 +++++----- test/parallel/test-crypto-getcipherinfo.js | 12 ++++---- test/parallel/test-crypto-hash-stream-pipe.js | 6 ++-- test/parallel/test-crypto-hash.js | 4 ++- test/parallel/test-crypto-hkdf.js | 4 +-- test/parallel/test-crypto-key-objects-raw.js | 28 +++++++++---------- test/parallel/test-crypto-key-objects.js | 11 ++++---- ...test-crypto-keygen-async-dsa-key-object.js | 12 ++++---- test/parallel/test-crypto-keygen-async-dsa.js | 17 +++++------ ...ypto-keygen-async-elliptic-curve-jwk-ec.js | 4 +-- ...-crypto-keygen-async-elliptic-curve-jwk.js | 4 +-- ...-explicit-elliptic-curve-encrypted-p256.js | 19 +++++++------ ...nc-explicit-elliptic-curve-encrypted.js.js | 16 ++++++----- ...to-keygen-async-explicit-elliptic-curve.js | 14 ++++++---- ...ync-named-elliptic-curve-encrypted-p256.js | 4 +-- .../parallel/test-crypto-keygen-bit-length.js | 9 ++++-- .../parallel/test-crypto-keygen-dh-classic.js | 5 ++-- test/parallel/test-crypto-keygen-eddsa.js | 4 +-- ...o-keygen-invalid-parameter-encoding-dsa.js | 5 ++-- ...test-crypto-keygen-no-rsassa-pss-params.js | 5 ++-- test/parallel/test-crypto-keygen-raw.js | 16 +++++------ .../test-crypto-keygen-rfc8017-9-1.js | 5 ++-- .../test-crypto-keygen-rfc8017-a-2-3.js | 5 ++-- test/parallel/test-crypto-keygen-rsa-pss.js | 14 ++++++---- test/parallel/test-crypto-keygen.js | 9 ++++-- .../test-crypto-mac-cache-snapshot.js | 4 +-- test/parallel/test-crypto-mac-cache.js | 4 +-- test/parallel/test-crypto-mac-errors.js | 4 +-- test/parallel/test-crypto-mac-unsupported.js | 4 +-- test/parallel/test-crypto-mac-vectors.js | 4 +-- test/parallel/test-crypto-mac.js | 4 +-- test/parallel/test-crypto-negative-zero.js | 4 +-- test/parallel/test-crypto-no-algorithm.js | 4 +-- test/parallel/test-crypto-oneshot-hash-xof.js | 4 ++- test/parallel/test-crypto-padding.js | 4 +-- .../test-crypto-pqc-encrypted-pkcs8.js | 6 ++-- .../test-crypto-pqc-key-objects-ml-dsa.js | 6 ++-- .../test-crypto-pqc-key-objects-ml-kem.js | 8 +++--- .../parallel/test-crypto-pqc-keygen-ml-dsa.js | 4 +-- .../parallel/test-crypto-pqc-keygen-ml-kem.js | 8 +++--- .../test-crypto-pqc-sign-verify-ml-dsa.js | 10 +++---- ...t-crypto-provider-cipher-cache-snapshot.js | 4 +-- .../test-crypto-provider-cipher-cache.js | 4 +-- .../test-crypto-provider-hash-options.js | 4 ++- test/parallel/test-crypto-provider-hashes.js | 4 +-- test/parallel/test-crypto-rsa-dsa.js | 13 +++++---- test/parallel/test-crypto-scrypt.js | 4 +-- test/parallel/test-crypto-sec-level.js | 4 ++- test/parallel/test-crypto-secure-heap.js | 9 ++++-- test/parallel/test-crypto-sign-verify.js | 15 +++++----- test/parallel/test-crypto-stream.js | 4 +-- test/parallel/test-crypto-x509.js | 18 ++++++------ test/parallel/test-crypto.js | 8 +++--- .../test-https-agent-additional-options.js | 6 ++-- .../test-https-agent-session-eviction.js | 4 +-- .../test-https-agent-session-reuse.js | 4 ++- .../test-https-client-renegotiation-limit.js | 4 ++- .../test-https-options-boolean-check.js | 4 ++- .../parallel/test-permission-openssl-store.js | 4 +-- ...rocess-env-allowed-flags-are-documented.js | 8 +++--- test/parallel/test-process-versions.js | 4 +-- test/parallel/test-tls-alert-handling.js | 7 +++-- test/parallel/test-tls-alert.js | 3 +- test/parallel/test-tls-cert-ext-encoding.js | 4 +-- test/parallel/test-tls-client-auth.js | 4 +-- .../test-tls-client-getephemeralkeyinfo.js | 9 ++++-- test/parallel/test-tls-client-mindhsize.js | 6 ++-- test/parallel/test-tls-client-reject.js | 12 ++++---- .../test-tls-client-renegotiation-13.js | 6 ++-- .../test-tls-client-renegotiation-limit.js | 4 +-- test/parallel/test-tls-dhe.js | 4 ++- .../test-tls-dhparam-auto-boringssl.js | 4 ++- .../test-tls-disable-renegotiation.js | 4 ++- test/parallel/test-tls-ecdh-multiple.js | 5 ++-- test/parallel/test-tls-empty-sni-context.js | 4 +-- test/parallel/test-tls-finished.js | 6 ++-- test/parallel/test-tls-getcipher.js | 4 ++- test/parallel/test-tls-getprotocol.js | 6 ++-- test/parallel/test-tls-honorcipherorder.js | 4 +-- test/parallel/test-tls-key-mismatch.js | 6 ++-- test/parallel/test-tls-legacy-pfx.js | 4 +-- test/parallel/test-tls-max-send-fragment.js | 4 ++- test/parallel/test-tls-min-max-version.js | 12 ++++---- test/parallel/test-tls-multi-key.js | 5 ++-- test/parallel/test-tls-multi-pfx.js | 5 ++-- test/parallel/test-tls-no-cert-required.js | 4 ++- .../test-tls-options-boolean-check.js | 4 ++- ...ls-psk-alpn-callback-exception-handling.js | 3 +- test/parallel/test-tls-psk-circuit.js | 5 ++-- test/parallel/test-tls-psk-server.js | 4 ++- .../test-tls-reduced-SECLEVEL-in-cipher.js | 4 ++- test/parallel/test-tls-server-verify.js | 4 +-- test/parallel/test-tls-session-cache.js | 3 +- test/parallel/test-tls-set-ciphers-error.js | 4 +-- ...ls-set-default-ca-certificates-recovery.js | 3 +- test/parallel/test-tls-set-sigalgs.js | 6 ++-- test/parallel/test-tls-ticket-cluster.js | 4 ++- test/parallel/test-tls-ticket.js | 4 ++- test/parallel/test-tls-write-error.js | 4 +-- test/parallel/test-trace-env.js | 4 +-- .../test-webcrypto-crypto-job-mode.js | 4 +-- .../test-webcrypto-deduplicate-usages.js | 8 +++--- .../test-webcrypto-derivebits-cfrg.js | 4 +-- .../test-webcrypto-derivebits-hkdf.js | 12 ++++---- test/parallel/test-webcrypto-derivebits.js | 4 +-- .../parallel/test-webcrypto-derivekey-cfrg.js | 4 +-- test/parallel/test-webcrypto-derivekey.js | 12 ++++---- test/parallel/test-webcrypto-digest.js | 6 ++-- .../test-webcrypto-encap-decap-ml-kem.js | 6 ++-- .../test-webcrypto-encrypt-decrypt.js | 4 +-- .../test-webcrypto-export-import-cfrg.js | 4 +-- .../test-webcrypto-export-import-ml-dsa.js | 8 +++--- .../test-webcrypto-export-import-ml-kem.js | 10 +++---- .../test-webcrypto-export-import-rsa.js | 4 ++- test/parallel/test-webcrypto-export-import.js | 4 +-- test/parallel/test-webcrypto-keygen.js | 18 ++++++------ .../test-webcrypto-sign-verify-eddsa.js | 4 +-- .../test-webcrypto-sign-verify-ml-dsa.js | 4 +-- .../test-webcrypto-sign-verify-rsa.js | 4 +-- test/parallel/test-webcrypto-sign-verify.js | 6 ++-- test/parallel/test-webcrypto-wrap-unwrap.js | 6 ++-- test/parallel/test-x509-escaping.js | 26 ++++++++--------- test/pummel/test-crypto-dh-hash.js | 4 +-- test/pummel/test-crypto-dh-keys.js | 4 +-- test/sequential/test-tls-psk-client.js | 4 ++- test/wpt/status/WebCryptoAPI.cjs | 7 +++-- 159 files changed, 561 insertions(+), 437 deletions(-) diff --git a/benchmark/crypto/create-keyobject.js b/benchmark/crypto/create-keyobject.js index 7cd6db2d567a..df95ad393234 100644 --- a/benchmark/crypto/create-keyobject.js +++ b/benchmark/crypto/create-keyobject.js @@ -1,7 +1,7 @@ 'use strict'; const common = require('../common.js'); -const { hasOpenSSL } = require('../../test/common/crypto.js'); +const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js'); const crypto = require('crypto'); const fs = require('fs'); const path = require('path'); @@ -26,7 +26,7 @@ const keyFixtures = { if (hasOpenSSL(3, 5)) { keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private'); -} else if (process.features.openssl_is_boringssl) { +} else if (isBoringSSL) { keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private_seed_only'); } diff --git a/benchmark/crypto/kem.js b/benchmark/crypto/kem.js index a544fc2124af..a59a57b65956 100644 --- a/benchmark/crypto/kem.js +++ b/benchmark/crypto/kem.js @@ -1,7 +1,7 @@ 'use strict'; const common = require('../common.js'); -const { hasOpenSSL } = require('../../test/common/crypto.js'); +const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js'); const crypto = require('crypto'); const fs = require('fs'); const path = require('path'); @@ -24,7 +24,7 @@ if (hasOpenSSL(3, 5)) { keyFixtures['ml-kem-512'] = readKeyPair('ml_kem_512_public', 'ml_kem_512_private'); keyFixtures['ml-kem-768'] = readKeyPair('ml_kem_768_public', 'ml_kem_768_private'); keyFixtures['ml-kem-1024'] = readKeyPair('ml_kem_1024_public', 'ml_kem_1024_private'); -} else if (process.features.openssl_is_boringssl) { +} else if (isBoringSSL) { keyFixtures['ml-kem-768'] = readKeyPair('ml_kem_768_public', 'ml_kem_768_private_seed_only'); keyFixtures['ml-kem-1024'] = readKeyPair('ml_kem_1024_public', 'ml_kem_1024_private_seed_only'); } diff --git a/benchmark/crypto/mac.js b/benchmark/crypto/mac.js index d1028fa414e6..ea9d3a56e59f 100644 --- a/benchmark/crypto/mac.js +++ b/benchmark/crypto/mac.js @@ -1,7 +1,7 @@ 'use strict'; const common = require('../common.js'); -const { hasOpenSSL } = require('../../test/common/crypto.js'); +const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js'); const assert = require('node:assert'); const { createHmac, @@ -10,7 +10,7 @@ const { } = require('node:crypto'); if (!hasOpenSSL(3) || - process.features.openssl_is_boringssl || + isBoringSSL || typeof createMac !== 'function' || typeof getMacs !== 'function') { console.log('Skipping: generic MAC API requires OpenSSL >= 3'); diff --git a/benchmark/crypto/oneshot-sign.js b/benchmark/crypto/oneshot-sign.js index 72e3726d9a53..78f0b5574aef 100644 --- a/benchmark/crypto/oneshot-sign.js +++ b/benchmark/crypto/oneshot-sign.js @@ -1,7 +1,7 @@ 'use strict'; const common = require('../common.js'); -const { hasOpenSSL } = require('../../test/common/crypto.js'); +const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js'); const crypto = require('crypto'); const fs = require('fs'); const path = require('path'); @@ -19,7 +19,7 @@ const keyFixtures = { if (hasOpenSSL(3, 5)) { keyFixtures['ml-dsa-44'] = readKey('ml_dsa_44_private'); -} else if (process.features.openssl_is_boringssl) { +} else if (isBoringSSL) { keyFixtures['ml-dsa-44'] = readKey('ml_dsa_44_private_seed_only'); } diff --git a/benchmark/crypto/oneshot-verify.js b/benchmark/crypto/oneshot-verify.js index 8b397b02dbf2..9aac91692dfc 100644 --- a/benchmark/crypto/oneshot-verify.js +++ b/benchmark/crypto/oneshot-verify.js @@ -1,7 +1,7 @@ 'use strict'; const common = require('../common.js'); -const { hasOpenSSL } = require('../../test/common/crypto.js'); +const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js'); const crypto = require('crypto'); const fs = require('fs'); const path = require('path'); @@ -26,7 +26,7 @@ const keyFixtures = { if (hasOpenSSL(3, 5)) { keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private'); -} else if (process.features.openssl_is_boringssl) { +} else if (isBoringSSL) { keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private_seed_only'); } diff --git a/test/addons/openssl-providers/providers.cjs b/test/addons/openssl-providers/providers.cjs index fc0f93ef45c8..7e7a958b9005 100644 --- a/test/addons/openssl-providers/providers.cjs +++ b/test/addons/openssl-providers/providers.cjs @@ -4,9 +4,9 @@ const common = require('../../common'); if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL3 } = require('../../common/crypto'); +const { hasOpenSSL } = require('../../common/crypto'); -if (!hasOpenSSL3) { +if (!hasOpenSSL(3)) { common.skip('this test requires OpenSSL 3.x'); } const assert = require('node:assert'); diff --git a/test/common/crypto.js b/test/common/crypto.js index 63f7487f15d3..49678e0de43a 100644 --- a/test/common/crypto.js +++ b/test/common/crypto.js @@ -123,6 +123,8 @@ const hasOpenSSL = (major = 0, minor = 0, patch = 0) => { return OPENSSL_VERSION_NUMBER >= opensslVersionNumber(major, minor, patch); }; +const isBoringSSL = process.features.openssl_is_boringssl; + const hasFIPS = (major = 0, minor = 0, patch = 0) => { return crypto.getFips() === 1 && hasOpenSSL(major, minor, patch); }; @@ -144,6 +146,7 @@ module.exports = { sec1EncExp, hasOpenSSL, hasFIPS, + isBoringSSL, get hasOpenSSL3() { return hasOpenSSL(3); }, diff --git a/test/fixtures/crypto/ecdsa.js b/test/fixtures/crypto/ecdsa.js index c3545fb20ec7..6da56a0601ff 100644 --- a/test/fixtures/crypto/ecdsa.js +++ b/test/fixtures/crypto/ecdsa.js @@ -1,5 +1,7 @@ 'use strict'; +const { isBoringSSL } = require('../../common/crypto'); + module.exports = function() { const pkcs8 = { 'P-256': Buffer.from( @@ -72,7 +74,7 @@ module.exports = function() { 'b6a0a14d7e4bc6dd2eda82c9234f174b670b60c8f7d101f68fdf5889e02373b025' + 'dcbc4c82f2929b8e06c68535da98e38fe399c53a814b097935581ef21535eb', 'hex'), - ...(!process.features.openssl_is_boringssl ? { + ...(!isBoringSSL ? { 'SHA3-256': Buffer.from( 'f6a48eb5557f484ed0c3e4b5c78a3cf497cbd346db06a4165d429248aa2cc51a69' + '747d09f57af145469a8b607a9b8b9709629d74e8f5ca337c6ddc581b6f6103', @@ -104,7 +106,7 @@ module.exports = function() { '72fbdb369fd34c1c54264d07f4facd69b02e4206f8a8bb259b882a305c56fde2d3' + '5107e493c53cd6b4af0b31306f4d03fd43cfc762a1030e17a3d775453a1212b142' + '9f7b3d93066a5f42a10b138cd177dc09616e827d598822d78d4627b754e6', 'hex'), - ...(!process.features.openssl_is_boringssl ? { + ...(!isBoringSSL ? { 'SHA3-256': Buffer.from( '0b07c078be30fa5925a307d6fc559c5f398e63fb5d007d6b24a834847f2d3d18d5' + 'b5e840711c52a7bc6626c3ced93301e873c013a706f6b297c12cc6d47a71e0529e' + @@ -144,7 +146,7 @@ module.exports = function() { '01f0071e6a32867fa70f695cd39c4e87e142b9e4134d38740bd6fee354a575167e' + '13524e94832637910fe11e53a85fb21b91adb81bb1779c4e2b8bc87c717dc35084', 'hex'), - ...(!process.features.openssl_is_boringssl ? { + ...(!isBoringSSL ? { 'SHA3-256': Buffer.from( '00463679f47a4c705e03447360dcf34d1743e0d4b2591cc66832a6bc80d92e538c' + '169a1fd330f98e7235ca7fec7e16ac44fb13095b8edf2c76b75c4845177d59e425' + @@ -170,7 +172,7 @@ module.exports = function() { const curves = ['P-256', 'P-384', 'P-521']; const hashes = ['SHA-1', 'SHA-256', 'SHA-384', 'SHA-512']; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { hashes.push('SHA3-256', 'SHA3-384', 'SHA3-512'); } diff --git a/test/fixtures/crypto/eddsa.js b/test/fixtures/crypto/eddsa.js index a5382219f4f3..4c91b044d72f 100644 --- a/test/fixtures/crypto/eddsa.js +++ b/test/fixtures/crypto/eddsa.js @@ -1,5 +1,7 @@ 'use strict'; +const { isBoringSSL } = require('../../common/crypto'); + const common = require('../../common'); module.exports = function() { @@ -46,7 +48,7 @@ module.exports = function() { const algorithms = ['Ed25519']; const contexts = [new Uint8Array(0), new Uint8Array(32), new Uint8Array(255)]; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { algorithms.push('Ed448') } else { common.printSkipMessage(`Skipping unsupported Ed448 test cases`); diff --git a/test/fixtures/crypto/hmac.js b/test/fixtures/crypto/hmac.js index acdf3229a4bc..55376a1299d8 100644 --- a/test/fixtures/crypto/hmac.js +++ b/test/fixtures/crypto/hmac.js @@ -1,5 +1,7 @@ 'use strict'; +const { isBoringSSL } = require('../../common/crypto'); + module.exports = function () { const plaintext = Buffer.from( '5f4dba4f320c0ce876725afce5fbd25bf83e5a7125a08cafe73c3ebac421779df9d55d' + @@ -22,7 +24,7 @@ module.exports = function () { '5dcc359443aaf652fa1375d6b3e61fdcf29bb4a28bd5d3dcfa40f82f906bb280' + '0455db03b5d31fb972a15a6d0103a24e56d156a119c0e5a1e92a44c3c5657cf9', 'hex'), - ...(!process.features.openssl_is_boringssl ? { + ...(!isBoringSSL ? { 'SHA3-256': Buffer.from( 'e588ec0811463d767241df1074b47ae4071b51f2ce36537ba69ccdc3fdc2b7a8', 'hex'), @@ -48,7 +50,7 @@ module.exports = function () { '61fb278c3ffb0cce2bf1cf723ddfd8ef1f931c0c618c25907324605939e3f9a2' + 'c6f4af690bda3407dc2f5770f6a0a44b954d64a332e3ee0821abf82b7f3e99c1', 'hex'), - ...(!process.features.openssl_is_boringssl ? { + ...(!isBoringSSL ? { 'SHA3-256': Buffer.from( 'c1ac5e11fcd50c48bf567f6e296632f5801c4eb07a8a47579b41dee971a3099b', 'hex'), diff --git a/test/fixtures/crypto/rsa_pkcs.js b/test/fixtures/crypto/rsa_pkcs.js index d54c44b6d820..74a8c0512ef4 100644 --- a/test/fixtures/crypto/rsa_pkcs.js +++ b/test/fixtures/crypto/rsa_pkcs.js @@ -1,5 +1,7 @@ 'use strict'; +const { isBoringSSL } = require('../../common/crypto'); + module.exports = function () { const pkcs8 = Buffer.from( '308204bf020100300d06092a864886f70d0101010500048204a9308204a50201000282' + @@ -97,7 +99,7 @@ module.exports = function () { '7a6335c70e193235dcda48add6858626bd96311e60f7e5ea4491b6c1e6248afe12b' + 'bbd54f8869b043a5b0444562813f0a98b300356f306e6b783a29f3bec97ca40ea20' + '062cab8926ec5d96aa387cc84821a6d72b8ea126e7d', 'hex'), - ...(!process.features.openssl_is_boringssl ? { + ...(!isBoringSSL ? { 'sha3-256': Buffer.from( 'be1b476c1911a01d71710fd8a2f3158d6f7839e91443b01bed30dfdd04336d80c6b' + 'f692c06fad254877901c10a73853e8fb202a29cddefdf16c3adcda1fc123625897d' + @@ -161,7 +163,7 @@ module.exports = function () { plaintext, signature: signatures['sha-512'] }, - ...(!process.features.openssl_is_boringssl ? [ + ...(!isBoringSSL ? [ { publicKeyBuffer: spki, privateKeyBuffer: pkcs8, diff --git a/test/fixtures/crypto/rsa_pss.js b/test/fixtures/crypto/rsa_pss.js index 423f2c4d77bf..4aeaf3330e78 100644 --- a/test/fixtures/crypto/rsa_pss.js +++ b/test/fixtures/crypto/rsa_pss.js @@ -1,5 +1,7 @@ 'use strict'; +const { isBoringSSL } = require('../../common/crypto'); + module.exports = function() { const pkcs8 = Buffer.from( '308204bf020100300d06092a864886f70d0101010500048204a9308204a5020100028' + @@ -150,7 +152,7 @@ module.exports = function() { 'b68c04bfe452c3adc6c10066a915231b7b404727eb6201b4921eb96d9407de2b963' + '3879ceb71d759d9828d7b4d062f6ef100757d8328187caf57dfb859d1555345207c' + '1cce7905c3564c08fec78867a53d5a2cf84810e1ffa', 'hex'), - ...(!process.features.openssl_is_boringssl ? { + ...(!isBoringSSL ? { 'sha3-512, no salt': Buffer.from( 'd2430dc87abeaa7d13f7cec8510f1a296e1c608f44b1696829c59a99e8eefe9b2ee' + '6ee8ad6fdc93c24fcba2f04d1da195924b6209717e1992c10ed9f4783478765fe34' + @@ -255,7 +257,7 @@ module.exports = function() { plaintext, signature: signatures['sha-512, salted'] }, - ...(!process.features.openssl_is_boringssl ? [ + ...(!isBoringSSL ? [ { publicKeyBuffer: spki, privateKeyBuffer: pkcs8, diff --git a/test/fixtures/webcrypto/supports-level-2.mjs b/test/fixtures/webcrypto/supports-level-2.mjs index 3d0f8a630394..61633ae95a12 100644 --- a/test/fixtures/webcrypto/supports-level-2.mjs +++ b/test/fixtures/webcrypto/supports-level-2.mjs @@ -13,8 +13,6 @@ const [ECDH, X25519] = await Promise.all([ subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']), ]); -const boringSSL = process.features.openssl_is_boringssl; - export const vectors = { 'encrypt': [ [false, 'Invalid'], diff --git a/test/fixtures/webcrypto/supports-modern-algorithms.mjs b/test/fixtures/webcrypto/supports-modern-algorithms.mjs index 4b44e02d479d..49863764505a 100644 --- a/test/fixtures/webcrypto/supports-modern-algorithms.mjs +++ b/test/fixtures/webcrypto/supports-modern-algorithms.mjs @@ -1,8 +1,8 @@ import * as crypto from 'node:crypto' -import { hasOpenSSL } from '../../common/crypto.js' +import { hasOpenSSL, isBoringSSL } from '../../common/crypto.js' -const boringSSL = process.features.openssl_is_boringssl; +const boringSSL = isBoringSSL; const pqc = hasOpenSSL(3, 5) || boringSSL; const argon2 = hasOpenSSL(3, 2); const shake128 = crypto.getHashes().includes('shake128'); diff --git a/test/fixtures/webcrypto/supports-secure-curves.mjs b/test/fixtures/webcrypto/supports-secure-curves.mjs index a3a84f6c9f9a..fa3f1d365213 100644 --- a/test/fixtures/webcrypto/supports-secure-curves.mjs +++ b/test/fixtures/webcrypto/supports-secure-curves.mjs @@ -1,10 +1,10 @@ -import { hasOpenSSL } from '../../common/crypto.js' +import { hasOpenSSL, isBoringSSL } from '../../common/crypto.js' const supportsContext = hasOpenSSL(3, 2); const { subtle } = globalThis.crypto; -const boringSSL = process.features.openssl_is_boringssl; +const boringSSL = isBoringSSL; const X25519 = await subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']); let X448; diff --git a/test/fixtures/webcrypto/supports-sha3.mjs b/test/fixtures/webcrypto/supports-sha3.mjs index 73f5b778eeb9..fe256dcfb168 100644 --- a/test/fixtures/webcrypto/supports-sha3.mjs +++ b/test/fixtures/webcrypto/supports-sha3.mjs @@ -1,6 +1,8 @@ +import { isBoringSSL } from '../../common/crypto.js' + const { subtle } = globalThis.crypto; -const boringSSL = process.features.openssl_is_boringssl; +const boringSSL = isBoringSSL; const RSA_KEY_GEN = { modulusLength: 2048, diff --git a/test/parallel/test-cli-node-options.js b/test/parallel/test-cli-node-options.js index 90c399790f65..375c46c11ab7 100644 --- a/test/parallel/test-cli-node-options.js +++ b/test/parallel/test-cli-node-options.js @@ -12,7 +12,7 @@ const { Worker } = require('worker_threads'); const fixtures = require('../common/fixtures'); const tmpdir = require('../common/tmpdir'); -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL } = require('../common/crypto'); tmpdir.refresh(); const printA = path.relative(tmpdir.path, fixtures.path('printA.js')); @@ -65,7 +65,7 @@ if (common.isLinux) { if (common.hasCrypto) { expectNoWorker('--use-openssl-ca', 'B\n'); expectNoWorker('--use-bundled-ca', 'B\n'); - if (!hasOpenSSL3) + if (!hasOpenSSL(3)) expectNoWorker('--openssl-config=_ossl_cfg', 'B\n'); if (common.isMacOS) { expect('--use-system-ca', 'B\n'); diff --git a/test/parallel/test-config-json-schema.js b/test/parallel/test-config-json-schema.js index 82679660a30f..08973bd17ee2 100644 --- a/test/parallel/test-config-json-schema.js +++ b/test/parallel/test-config-json-schema.js @@ -10,9 +10,9 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL } = require('../common/crypto'); -if (!hasOpenSSL3) { +if (!hasOpenSSL(3)) { common.skip('this test requires OpenSSL 3.x'); } diff --git a/test/parallel/test-crypto-async-sign-verify.js b/test/parallel/test-crypto-async-sign-verify.js index 96b4b5d90679..a60dc73d67b3 100644 --- a/test/parallel/test-crypto-async-sign-verify.js +++ b/test/parallel/test-crypto-async-sign-verify.js @@ -3,7 +3,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const util = require('util'); const crypto = require('crypto'); @@ -100,7 +100,7 @@ test('rsa_public.pem', 'rsa_private.pem', 'sha256', false, // ED25519 test('ed25519_public.pem', 'ed25519_private.pem', undefined, true); -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { // ED448 test('ed448_public.pem', 'ed448_private.pem', undefined, true); @@ -173,7 +173,7 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc= let expected = /no default digest/; let expectedCode = 'ERR_OSSL_EVP_NO_DEFAULT_DIGEST'; - if (hasOpenSSL(3) || process.features.openssl_is_boringssl) { + if (hasOpenSSL(3) || isBoringSSL) { expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i; expectedCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE'; } diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js index 3ad34729f871..f11778ee7708 100644 --- a/test/parallel/test-crypto-authenticated.js +++ b/test/parallel/test-crypto-authenticated.js @@ -29,7 +29,7 @@ const assert = require('assert'); const crypto = require('crypto'); const { inspect } = require('util'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const isFipsEnabled = crypto.getFips() === 1; const fips3 = hasFIPS(3); @@ -834,7 +834,7 @@ if (fips3) { }), { code: 'ERR_OSSL_EVP_UNSUPPORTED', }); -} else if (!process.features.openssl_is_boringssl) { +} else if (!isBoringSSL) { const key = Buffer.alloc(32); const iv = Buffer.alloc(12); @@ -852,7 +852,7 @@ if (fips3) { // ChaCha20-Poly1305 should respect the authTagLength option and should not // require the authentication tag before calls to update() during decryption. -if (!fips3 && !process.features.openssl_is_boringssl) { +if (!fips3 && !isBoringSSL) { const key = Buffer.alloc(32); const iv = Buffer.alloc(12); @@ -903,7 +903,7 @@ if (!fips3 && !process.features.openssl_is_boringssl) { // shorter tags as long as their length was valid according to NIST SP 800-38D. // For ChaCha20-Poly1305, we intentionally deviate from that because there are // no recommended or approved authentication tag lengths below 16 bytes. -if (!fips3 && !process.features.openssl_is_boringssl) { +if (!fips3 && !isBoringSSL) { const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => { return algo === 'chacha20-poly1305' && tampered === false; }); @@ -942,7 +942,7 @@ if (!fips3 && !process.features.openssl_is_boringssl) { } // https://github.com/nodejs/node/issues/45874 -if (!fips3 && !process.features.openssl_is_boringssl) { +if (!fips3 && !isBoringSSL) { const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => { return algo === 'chacha20-poly1305' && tampered === false; }); diff --git a/test/parallel/test-crypto-boringssl-evp-list.js b/test/parallel/test-crypto-boringssl-evp-list.js index 3f142c24f28a..f2d8fd4796c0 100644 --- a/test/parallel/test-crypto-boringssl-evp-list.js +++ b/test/parallel/test-crypto-boringssl-evp-list.js @@ -1,10 +1,12 @@ 'use strict'; const common = require('../common'); + +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); -if (!process.features.openssl_is_boringssl) +if (!isBoringSSL) common.skip('BoringSSL-only test'); const assert = require('assert'); diff --git a/test/parallel/test-crypto-certificate.js b/test/parallel/test-crypto-certificate.js index 6462654680ea..54f61d8a3f6e 100644 --- a/test/parallel/test-crypto-certificate.js +++ b/test/parallel/test-crypto-certificate.js @@ -26,7 +26,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const { Certificate } = crypto; const fixtures = require('../common/fixtures'); @@ -42,7 +42,7 @@ function copyArrayBuffer(buf) { function checkMethods(certificate) { - if (!process.features.openssl_is_boringssl) + if (!isBoringSSL) assert.strictEqual(certificate.verifySpkac(spkacValid), !hasFIPS(3)); assert.strictEqual(certificate.verifySpkac(spkacFail), false); @@ -58,7 +58,7 @@ function checkMethods(certificate) { ); assert.strictEqual(certificate.exportChallenge(spkacFail), ''); - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { const ab = copyArrayBuffer(spkacValid); const expected = !hasFIPS(3); assert.strictEqual(certificate.verifySpkac(ab), expected); diff --git a/test/parallel/test-crypto-dh-curves.js b/test/parallel/test-crypto-dh-curves.js index ee8849163ae8..16a4f0dccff3 100644 --- a/test/parallel/test-crypto-dh-curves.js +++ b/test/parallel/test-crypto-dh-curves.js @@ -5,7 +5,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const { DH_CHECK_P_NOT_PRIME, DH_CHECK_P_NOT_SAFE_PRIME, @@ -21,7 +21,7 @@ const p = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' + 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF'; crypto.createDiffieHellman(p, 'hex'); -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { const notPrime = Buffer.from(p, 'hex'); notPrime[notPrime.length - 1] = 0xfd; assert.strictEqual( @@ -63,7 +63,7 @@ assert.throws( }); // Confirm DH_check() results are exposed for optional examination. -const bad_dh = process.features.openssl_is_boringssl ? +const bad_dh = isBoringSSL ? crypto.createDiffieHellman('abcd', 'hex', 0) : crypto.createDiffieHellman('02', 'hex'); assert.notStrictEqual(bad_dh.verifyError, 0); @@ -77,7 +77,7 @@ if (hasOpenSSL(3)) { () => crypto.createDiffieHellman(Buffer.from(p, 'hex'), Buffer.from(p, 'hex')), { code: 'ERR_OSSL_DH_BAD_GENERATOR' }); -} else if (!process.features.openssl_is_boringssl) { +} else if (!isBoringSSL) { assert.strictEqual( crypto.createDiffieHellman(Buffer.from(p, 'hex'), Buffer.from(p, 'hex')).verifyError, diff --git a/test/parallel/test-crypto-dh-errors.js b/test/parallel/test-crypto-dh-errors.js index 3ff9b746e020..d9f7065655cb 100644 --- a/test/parallel/test-crypto-dh-errors.js +++ b/test/parallel/test-crypto-dh-errors.js @@ -5,7 +5,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL } = require('../common/crypto'); // https://github.com/nodejs/node/issues/32738 // XXX(bnoordhuis) validateInt32() throwing ERR_OUT_OF_RANGE and RangeError @@ -25,7 +25,7 @@ assert.throws(() => crypto.createDiffieHellman('abcdef', 13.37), { }); for (const bits of [-1, 0, 1]) { - if (hasOpenSSL3) { + if (hasOpenSSL(3)) { assert.throws(() => crypto.createDiffieHellman(bits), { code: 'ERR_OSSL_DH_MODULUS_TOO_SMALL', name: 'Error', diff --git a/test/parallel/test-crypto-dh-group-setters.js b/test/parallel/test-crypto-dh-group-setters.js index 37d0a44d0e1e..ccc370e2352d 100644 --- a/test/parallel/test-crypto-dh-group-setters.js +++ b/test/parallel/test-crypto-dh-group-setters.js @@ -1,12 +1,14 @@ 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); const crypto = require('crypto'); -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { common.skip('Skipping unsupported Diffie-Hellman tests'); } diff --git a/test/parallel/test-crypto-dh-modp2-views.js b/test/parallel/test-crypto-dh-modp2-views.js index e32c515e1536..ce2d8823beec 100644 --- a/test/parallel/test-crypto-dh-modp2-views.js +++ b/test/parallel/test-crypto-dh-modp2-views.js @@ -5,9 +5,9 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasFIPS, modp2buf } = require('../common/crypto'); +const { hasFIPS, modp2buf, isBoringSSL } = require('../common/crypto'); -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { common.skip('Skipping unsupported Diffie-Hellman tests'); } diff --git a/test/parallel/test-crypto-dh-modp2.js b/test/parallel/test-crypto-dh-modp2.js index 0bf36f93a39a..a0ec31a1eb4f 100644 --- a/test/parallel/test-crypto-dh-modp2.js +++ b/test/parallel/test-crypto-dh-modp2.js @@ -5,9 +5,9 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasFIPS, modp2buf } = require('../common/crypto'); +const { hasFIPS, modp2buf, isBoringSSL } = require('../common/crypto'); -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { common.skip('Skipping unsupported Diffie-Hellman tests'); } diff --git a/test/parallel/test-crypto-dh-stateless.js b/test/parallel/test-crypto-dh-stateless.js index 0ade828eb234..9c0270304f2a 100644 --- a/test/parallel/test-crypto-dh-stateless.js +++ b/test/parallel/test-crypto-dh-stateless.js @@ -5,8 +5,11 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasOpenSSL } = require('../common/crypto'); -const isBoringSSL = process.features.openssl_is_boringssl; +const { + hasOpenSSL, + isBoringSSL: commonIsBoringSSL, +} = require('../common/crypto'); +const isBoringSSL = commonIsBoringSSL; // Error code for a key-type mismatch during (EC)DH. The underlying OpenSSL // error code varies by version, and in OpenSSL 4.0 by platform: some builds diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js index f5d239f1d457..7b9a9d50d890 100644 --- a/test/parallel/test-crypto-dh.js +++ b/test/parallel/test-crypto-dh.js @@ -9,6 +9,7 @@ const crypto = require('crypto'); const { hasOpenSSL, hasFIPS, + isBoringSSL, } = require('../common/crypto'); { @@ -100,7 +101,7 @@ const { // Through a fluke of history, g=0 defaults to DH_GENERATOR (2). { const g = 0; - if (process.features.openssl_is_boringssl) { + if (isBoringSSL) { assert.throws(() => crypto.createDiffieHellman('abcdef', g), { code: 'ERR_CRYPTO_OPERATION_FAILED', name: 'Error' @@ -112,7 +113,7 @@ const { } { - if (process.features.openssl_is_boringssl) { + if (isBoringSSL) { assert.throws(() => crypto.createDiffieHellman('abcdef', Buffer.from([2])), { code: 'ERR_CRYPTO_OPERATION_FAILED', name: 'Error' diff --git a/test/parallel/test-crypto-ecb.js b/test/parallel/test-crypto-ecb.js index 06c88272438a..65c373d35d25 100644 --- a/test/parallel/test-crypto-ecb.js +++ b/test/parallel/test-crypto-ecb.js @@ -25,14 +25,14 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL } = require('../common/crypto'); const crypto = require('crypto'); if (crypto.getFips()) { common.skip('BF-ECB is not FIPS 140-2 compatible'); } -if (hasOpenSSL3) { +if (hasOpenSSL(3)) { common.skip('Blowfish is only available with the legacy provider in ' + 'OpenSSl 3.x'); } diff --git a/test/parallel/test-crypto-eddsa-variants.js b/test/parallel/test-crypto-eddsa-variants.js index 3a75a7bf4f6f..10e9fba7e52c 100644 --- a/test/parallel/test-crypto-eddsa-variants.js +++ b/test/parallel/test-crypto-eddsa-variants.js @@ -8,6 +8,7 @@ const crypto = require('crypto'); const { hasOpenSSL, hasFIPS, + isBoringSSL, } = require('../common/crypto'); // RFC 8032 Section 7 test vectors for Ed25519, Ed25519ctx, and Ed448. @@ -180,7 +181,7 @@ function createKeyPair(algorithm, secretKeyHex, publicKeyHex) { } for (const v of vectors) { - if (v.algorithm.startsWith('Ed448') && process.features.openssl_is_boringssl) continue; + if (v.algorithm.startsWith('Ed448') && isBoringSSL) continue; if (v.algorithm.endsWith('ctx') || v.context) { if (!hasOpenSSL(3, 2)) continue; } diff --git a/test/parallel/test-crypto-encap-decap.js b/test/parallel/test-crypto-encap-decap.js index 7cafa0f2aa93..199ad68fa365 100644 --- a/test/parallel/test-crypto-encap-decap.js +++ b/test/parallel/test-crypto-encap-decap.js @@ -6,10 +6,14 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { + hasOpenSSL, + hasFIPS, + isBoringSSL: commonIsBoringSSL, +} = require('../common/crypto'); const { promisify } = require('util'); -const isBoringSSL = process.features.openssl_is_boringssl; +const isBoringSSL = commonIsBoringSSL; const isFips = hasFIPS(3); if (!hasOpenSSL(3) && !isBoringSSL) { diff --git a/test/parallel/test-crypto-fips-indicator-strict.js b/test/parallel/test-crypto-fips-indicator-strict.js index cc65d0016269..5e003d7015b2 100644 --- a/test/parallel/test-crypto-fips-indicator-strict.js +++ b/test/parallel/test-crypto-fips-indicator-strict.js @@ -6,7 +6,13 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -if (process.features.openssl_is_boringssl) { +const { + isBoringSSL, + hasFIPS, + hasOpenSSL, +} = require('../common/crypto'); + +if (isBoringSSL) { common.skip('BoringSSL does not support FIPS'); } @@ -18,7 +24,6 @@ const { Worker } = require('node:worker_threads'); const { spawnSyncAndExitWithoutError, } = require('../common/child_process'); -const { hasFIPS, hasOpenSSL } = require('../common/crypto'); const channelName = 'crypto.fips.indicator'; const mode = process.env.NODE_TEST_FIPS_FORCE_MODE; diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js index ea20d895b1c8..ad67ec181c7e 100644 --- a/test/parallel/test-crypto-fips.js +++ b/test/parallel/test-crypto-fips.js @@ -4,7 +4,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) +const { isBoringSSL, hasOpenSSL } = require('../common/crypto'); + +if (isBoringSSL) common.skip('BoringSSL does not support FIPS'); const assert = require('assert'); @@ -14,7 +16,6 @@ const { spawnSyncAndAssert } = require('../common/child_process'); const fixtures = require('../common/fixtures'); const { internalBinding } = require('internal/test/binding'); const { testFipsCrypto } = internalBinding('crypto'); -const { hasOpenSSL, hasOpenSSL3 } = require('../common/crypto'); const FIPS_ENABLED = 1; const FIPS_DISABLED = 0; @@ -23,11 +24,11 @@ const FIPS_ERROR_STRING2 = '--force-fips at startup.'; const FIPS_UNSUPPORTED_ERROR_STRING = 'fips mode not supported'; const FIPS_ENABLE_ERROR_STRING = - hasOpenSSL3 ? + hasOpenSSL(3) ? '--enable-fips requires an active OpenSSL provider named "fips"' : 'OpenSSL error when trying to enable FIPS:'; const FIPS_FORCE_ERROR_STRING = - hasOpenSSL3 ? + hasOpenSSL(3) ? '--force-fips requires an active OpenSSL provider named "fips"' : 'OpenSSL error when trying to enable FIPS:'; @@ -146,7 +147,7 @@ if (!sharedOpenSSL()) { 'require("crypto").getFips()', { ...process.env, 'OPENSSL_CONF': ' ' }); - if (hasOpenSSL3) { + if (hasOpenSSL(3)) { // Disabling FIPS mode should not throw after OpenSSL updates the default // property query. testHelper( @@ -191,7 +192,7 @@ assert.ok(test_result === 1 || test_result === 0); // ("Error: Cannot set FIPS mode in a non-FIPS build."). // Due to this uncertainty the following tests are skipped when configured // with --shared-openssl. -if (!sharedOpenSSL() && !hasOpenSSL3) { +if (!sharedOpenSSL() && !hasOpenSSL(3)) { // OpenSSL config file should be able to turn on FIPS mode testHelper( 'stdout', @@ -224,7 +225,7 @@ if (!sharedOpenSSL() && !hasOpenSSL3) { // will not work as expected with that version. // TODO(danbev) Revisit these test once FIPS support is available in // OpenSSL 3.x. -if (!hasOpenSSL3) { +if (!hasOpenSSL(3)) { testHelper( 'stdout', [`--openssl-config=${CNF_FIPS_OFF}`], diff --git a/test/parallel/test-crypto-getcipherinfo.js b/test/parallel/test-crypto-getcipherinfo.js index 5afd2e5a4208..faf45c766c5c 100644 --- a/test/parallel/test-crypto-getcipherinfo.js +++ b/test/parallel/test-crypto-getcipherinfo.js @@ -10,7 +10,7 @@ const { getCiphers, getCipherInfo, } = require('crypto'); -const { hasFIPS, hasOpenSSL3 } = require('../common/crypto'); +const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); @@ -18,7 +18,7 @@ const ciphers = getCiphers(); assert.strictEqual(getCipherInfo(-1), undefined); assert.strictEqual(getCipherInfo('cipher that does not exist'), undefined); -if (hasOpenSSL3) { +if (hasOpenSSL(3)) { assert.deepStrictEqual( ciphers.filter((cipher) => cipher.includes('cbc-hmac')), []); for (const cipher of [ @@ -54,7 +54,7 @@ if (ciphers.includes('aes-128-wrap-inv')) { } assert(!ciphers.some((cipher) => /^\d+(?:\.\d+)+$/.test(cipher))); -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { // A failed provider fetch must not contaminate the OpenSSL error queue. assert.throws(() => createHash('sha256', { outputLength: 28 }), { code: 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH', @@ -63,7 +63,7 @@ if (!process.features.openssl_is_boringssl) { for (const cipher of ciphers) { const info = getCipherInfo(cipher); - if (process.features.openssl_is_boringssl && !info) { + if (isBoringSSL && !info) { // BoringSSL reports some legacy ciphers in getCiphers() but returns no // info for them (e.g. des-ede3, des-ede3-ecb, rc2-40-cbc). common.printSkipMessage(`Skipping unsupported ${cipher} test case`); @@ -115,7 +115,7 @@ assert(getCipherInfo('aes-128-cbc', { ivLength: 16 })); assert(!getCipherInfo('aes-128-ccm', { ivLength: 1 })); assert(!getCipherInfo('aes-128-ccm', { ivLength: 14 })); -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { for (let n = 7; n <= 13; n++) assert(getCipherInfo('aes-128-ccm', { ivLength: n })); } else { @@ -126,7 +126,7 @@ assert(!getCipherInfo('aes-128-ocb', { ivLength: 16 })); if (hasFIPS(3)) { assert.strictEqual( getCipherInfo('aes-128-ocb', { ivLength: 12 }), undefined); -} else if (!process.features.openssl_is_boringssl) { +} else if (!isBoringSSL) { for (let n = 1; n < 16; n++) assert(getCipherInfo('aes-128-ocb', { ivLength: n })); } else { diff --git a/test/parallel/test-crypto-hash-stream-pipe.js b/test/parallel/test-crypto-hash-stream-pipe.js index ac851646a918..c6b9433456ea 100644 --- a/test/parallel/test-crypto-hash-stream-pipe.js +++ b/test/parallel/test-crypto-hash-stream-pipe.js @@ -20,7 +20,9 @@ // USE OR OTHER DEALINGS IN THE SOFTWARE. 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); @@ -30,10 +32,10 @@ const crypto = require('crypto'); const stream = require('stream'); const s = new stream.PassThrough(); -const h = process.features.openssl_is_boringssl ? +const h = isBoringSSL ? crypto.createHash('sha512') : crypto.createHash('sha3-512'); -const expect = process.features.openssl_is_boringssl ? +const expect = isBoringSSL ? 'fba055c6fd0c5b6645407749ed7a8b41' + 'b8f629f2163c3ca3701d864adabda1f8' + '93c37bf82b22fdd151ba8e357f611da4' + diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js index 44734e7aeb6f..7039b2c75d5c 100644 --- a/test/parallel/test-crypto-hash.js +++ b/test/parallel/test-crypto-hash.js @@ -1,5 +1,7 @@ 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) { common.skip('missing crypto'); } @@ -189,7 +191,7 @@ assert.throws( } // Test XOF hash functions and the outputLength option. -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { const invalidXofLength = { code: 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH', name: 'Error', diff --git a/test/parallel/test-crypto-hkdf.js b/test/parallel/test-crypto-hkdf.js index bfde3b324331..80a0a5dea4af 100644 --- a/test/parallel/test-crypto-hkdf.js +++ b/test/parallel/test-crypto-hkdf.js @@ -13,7 +13,7 @@ const { hkdfSync, getHashes } = require('crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); { assert.throws(() => hkdf(), { @@ -125,7 +125,7 @@ const algorithms = [ ['sha256', '', 'salt', '', 10], ['sha512', 'secret', 'salt', '', 15], ]; -if (!hasOpenSSL(3) && !process.features.openssl_is_boringssl) +if (!hasOpenSSL(3) && !isBoringSSL) algorithms.push(['whirlpool', 'secret', '', 'info', 20]); algorithms.forEach(([ hash, secret, salt, info, length ]) => { diff --git a/test/parallel/test-crypto-key-objects-raw.js b/test/parallel/test-crypto-key-objects-raw.js index 024d5f6f199f..4a129d1a6185 100644 --- a/test/parallel/test-crypto-key-objects-raw.js +++ b/test/parallel/test-crypto-key-objects-raw.js @@ -7,7 +7,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); // EC: NIST and OpenSSL curve names are both recognized for raw-public and raw-private { @@ -67,7 +67,7 @@ const { hasOpenSSL } = require('../common/crypto'); ['x25519', 'x25519_public.pem'], ]; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { rawPublicKeys.push( ['ed448', 'ed448_public.pem'], ['x448', 'x448_public.pem'], @@ -76,7 +76,7 @@ const { hasOpenSSL } = require('../common/crypto'); common.printSkipMessage('Skipping unsupported ed448/x448 test cases'); } - if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { + if (hasOpenSSL(3, 5) || isBoringSSL) { rawPublicKeys.push( ['ml-dsa-44', 'ml_dsa_44_public.pem'], ['ml-kem-768', 'ml_kem_768_public.pem'], @@ -122,7 +122,7 @@ if (hasOpenSSL(3, 5)) { const unsupportedKeyTypes = [ ['rsa', 'rsa_public_2048.pem', 'rsa_private_2048.pem'], ]; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { unsupportedKeyTypes.push(['dsa', 'dsa_public.pem', 'dsa_private.pem']); } else { common.printSkipMessage('Skipping unsupported dsa test case'); @@ -148,7 +148,7 @@ if (hasOpenSSL(3, 5)) { } // DH keys also don't support raw formats - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { const privKeyObj = crypto.createPrivateKey( fixtures.readKey('dh_private.pem', 'ascii')); assert.throws(() => privKeyObj.export({ format: 'raw-private' }), @@ -170,7 +170,7 @@ if (hasOpenSSL(3, 5)) { // PQC import throws when PQC is not supported if (!hasOpenSSL(3, 5)) { - const unsupported = process.features.openssl_is_boringssl ? + const unsupported = isBoringSSL ? // BoringSSL supports ML-DSA and ML-KEM-{768,1024}, but not ML-KEM-512 or SLH-DSA. ['ml-kem-512', 'slh-dsa-sha2-128f', 'slh-dsa-shake-128f'] : [ @@ -232,7 +232,7 @@ if (!hasOpenSSL(3, 5)) { } // ML-KEM: public keys of different type cannot be imported as the other type -if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { +if (hasOpenSSL(3, 5) || isBoringSSL) { const mlKem768Pub = crypto.createPublicKey( fixtures.readKey('ml_kem_768_public.pem', 'ascii')); const mlKem1024Pub = crypto.createPublicKey( @@ -251,7 +251,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { } // ML-DSA: -44 and -65 public keys cannot be imported as the other type -if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { +if (hasOpenSSL(3, 5) || isBoringSSL) { const mlDsa44Pub = crypto.createPublicKey( fixtures.readKey('ml_dsa_44_public.pem', 'ascii')); const mlDsa65Pub = crypto.createPublicKey( @@ -333,10 +333,10 @@ if (hasOpenSSL(3, 5)) { namedCurve: 'P-256', }), { code: 'ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS' }); - if (process.features.openssl_is_boringssl) { + if (isBoringSSL) { common.printSkipMessage('Skipping unsupported ed448/x448 test cases'); } - for (const type of process.features.openssl_is_boringssl ? + for (const type of isBoringSSL ? ['ed25519', 'x25519'] : ['ed25519', 'ed448', 'x25519', 'x448']) { const priv = crypto.createPrivateKey( @@ -364,7 +364,7 @@ if (hasOpenSSL(3, 5)) { } // raw-private cannot be used for ml-kem and ml-dsa -if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { +if (hasOpenSSL(3, 5) || isBoringSSL) { for (const type of ['ml-kem-768', 'ml-dsa-44']) { const priv = crypto.createPrivateKey( fixtures.readKey(`${type.replaceAll('-', '_')}_private_seed_only.pem`, 'ascii')); @@ -472,7 +472,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { { code: 'ERR_INVALID_ARG_VALUE' }); // PQC raw-seed -> createPublicKey - if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { + if (hasOpenSSL(3, 5) || isBoringSSL) { const mlDsaPriv = crypto.createPrivateKey( fixtures.readKey('ml_dsa_44_private_seed_only.pem', 'ascii')); const mlDsaPub = crypto.createPublicKey( @@ -521,10 +521,10 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { // x25519, ed25519, x448, and ed448 cannot be used as 'ec' namedCurve values { - if (process.features.openssl_is_boringssl) { + if (isBoringSSL) { common.printSkipMessage('Skipping unsupported ed448/x448 test cases'); } - for (const type of process.features.openssl_is_boringssl ? + for (const type of isBoringSSL ? ['ed25519', 'x25519'] : ['ed25519', 'x25519', 'ed448', 'x448']) { const priv = crypto.createPrivateKey( diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js index ba9a05387f21..fbd2ae6ff1c4 100644 --- a/test/parallel/test-crypto-key-objects.js +++ b/test/parallel/test-crypto-key-objects.js @@ -27,6 +27,7 @@ const { const { hasOpenSSL, hasFIPS, + isBoringSSL, } = require('../common/crypto'); const fips3 = hasFIPS(3); @@ -351,7 +352,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem', createPrivateKey({ key: '' }); }, hasOpenSSL(3) ? { message: 'error:1E08010C:DECODER routines::unsupported', - } : process.features.openssl_is_boringssl ? { + } : isBoringSSL ? { message: 'error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE', code: 'ERR_OSSL_PEM_NO_START_LINE', reason: 'NO_START_LINE', @@ -384,7 +385,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem', }, hasOpenSSL(3) ? { message: /error:1E08010C:DECODER routines::unsupported/, library: 'DECODER routines' - } : process.features.openssl_is_boringssl ? { + } : isBoringSSL ? { library: 'public key routines', message: 'error:06000066:public key routines:OPENSSL_internal:DECODE_ERROR' } : { @@ -439,7 +440,7 @@ for (const info of [ const fipsUnsupported = rejectsXCurves && keyType.startsWith('x'); - if (process.features.openssl_is_boringssl && keyType.endsWith('448')) { + if (isBoringSSL && keyType.endsWith('448')) { common.printSkipMessage(`Skipping unsupported ${keyType} test case`); continue; } @@ -631,7 +632,7 @@ for (const info of [ const { keyType, namedCurve } = info; const fipsUnsupported = fips3 && namedCurve === 'secp256k1'; - if (process.features.openssl_is_boringssl && !getCurves().includes(namedCurve)) { + if (isBoringSSL && !getCurves().includes(namedCurve)) { common.printSkipMessage(`Skipping unsupported ${keyType} test case`); continue; } @@ -861,7 +862,7 @@ for (const info of [ { code: 'ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE' }); } -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { // Test RSA-PSS. { // This key pair does not restrict the message digest algorithm or salt diff --git a/test/parallel/test-crypto-keygen-async-dsa-key-object.js b/test/parallel/test-crypto-keygen-async-dsa-key-object.js index ea35facbdc7e..52c82ea5725c 100644 --- a/test/parallel/test-crypto-keygen-async-dsa-key-object.js +++ b/test/parallel/test-crypto-keygen-async-dsa-key-object.js @@ -4,7 +4,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) +const { isBoringSSL, hasOpenSSL } = require('../common/crypto'); + +if (isBoringSSL) common.skip('not supported by BoringSSL'); const assert = require('assert'); @@ -12,25 +14,23 @@ const { generateKeyPair, } = require('crypto'); -const { hasOpenSSL3 } = require('../common/crypto'); - // Test async DSA key object generation. { generateKeyPair('dsa', { - modulusLength: hasOpenSSL3 ? 2048 : 512, + modulusLength: hasOpenSSL(3) ? 2048 : 512, divisorLength: 256 }, common.mustSucceed((publicKey, privateKey) => { assert.strictEqual(publicKey.type, 'public'); assert.strictEqual(publicKey.asymmetricKeyType, 'dsa'); assert.deepStrictEqual(publicKey.asymmetricKeyDetails, { - modulusLength: hasOpenSSL3 ? 2048 : 512, + modulusLength: hasOpenSSL(3) ? 2048 : 512, divisorLength: 256 }); assert.strictEqual(privateKey.type, 'private'); assert.strictEqual(privateKey.asymmetricKeyType, 'dsa'); assert.deepStrictEqual(privateKey.asymmetricKeyDetails, { - modulusLength: hasOpenSSL3 ? 2048 : 512, + modulusLength: hasOpenSSL(3) ? 2048 : 512, divisorLength: 256 }); })); diff --git a/test/parallel/test-crypto-keygen-async-dsa.js b/test/parallel/test-crypto-keygen-async-dsa.js index 6c7129c7efba..5d0254491cd2 100644 --- a/test/parallel/test-crypto-keygen-async-dsa.js +++ b/test/parallel/test-crypto-keygen-async-dsa.js @@ -4,20 +4,21 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) - common.skip('not supported by BoringSSL'); - -const assert = require('assert'); -const { - generateKeyPair, -} = require('crypto'); const { + isBoringSSL, assertApproximateSize, testSignVerify, spkiExp, + hasOpenSSL, } = require('../common/crypto'); -const { hasOpenSSL } = require('../common/crypto'); +if (isBoringSSL) + common.skip('not supported by BoringSSL'); + +const assert = require('assert'); +const { + generateKeyPair, +} = require('crypto'); // Test async DSA key generation. { diff --git a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js index bde6dc1d694b..9b81c700a231 100644 --- a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js +++ b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js @@ -8,12 +8,12 @@ const assert = require('assert'); const { generateKeyPair, } = require('crypto'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); // Test async elliptic curve key generation with 'jwk' encoding and named // curve. for (const curve of ['P-384', 'P-256', 'P-521', 'secp256k1']) { - if (process.features.openssl_is_boringssl && curve === 'secp256k1') { + if (isBoringSSL && curve === 'secp256k1') { common.printSkipMessage(`Skipping unsupported ${curve} test case`); continue; } diff --git a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js index cfef18c889b6..9985631b4093 100644 --- a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js +++ b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js @@ -8,13 +8,13 @@ const assert = require('assert'); const { generateKeyPair, } = require('crypto'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const rejectsXCurves = hasFIPS(3, 5); // Test async elliptic curve key generation with 'jwk' encoding. { for (const type of ['ed25519', 'ed448', 'x25519', 'x448']) { - if (process.features.openssl_is_boringssl && type.endsWith('448')) { + if (isBoringSSL && type.endsWith('448')) { common.printSkipMessage(`Skipping unsupported ${type} test case`); continue; } diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js index 246cbe5dd1ac..cd7e59be97fa 100644 --- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js +++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js @@ -4,20 +4,21 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) - common.skip('BoringSSL does not support paramEncoding: explicit'); - -const assert = require('assert'); -const { - generateKeyPair, -} = require('crypto'); const { + isBoringSSL, testSignVerify, spkiExp, pkcs8EncExp, + hasOpenSSL, } = require('../common/crypto'); -const { hasOpenSSL3 } = require('../common/crypto'); +if (isBoringSSL) + common.skip('BoringSSL does not support paramEncoding: explicit'); + +const assert = require('assert'); +const { + generateKeyPair, +} = require('crypto'); // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted // private key with paramEncoding explicit. @@ -43,7 +44,7 @@ const { hasOpenSSL3 } = require('../common/crypto'); // Since the private key is encrypted, signing shouldn't work anymore. assert.throws(() => testSignVerify(publicKey, privateKey), - hasOpenSSL3 ? { + hasOpenSSL(3) ? { message: 'error:07880109:common libcrypto ' + 'routines::interrupted or cancelled' } : { diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js index 081e709f46ec..5c0878fc634f 100644 --- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js +++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js @@ -4,14 +4,8 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) - common.skip('BoringSSL does not support paramEncoding: explicit'); - -const assert = require('assert'); -const { - generateKeyPair, -} = require('crypto'); const { + isBoringSSL, hasFIPS, testSignVerify, spkiExp, @@ -19,6 +13,14 @@ const { hasOpenSSL, } = require('../common/crypto'); +if (isBoringSSL) + common.skip('BoringSSL does not support paramEncoding: explicit'); + +const assert = require('assert'); +const { + generateKeyPair, +} = require('crypto'); + { // Test async explicit elliptic curve key generation with an encrypted // private key. diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js index 8084cdfc0b3b..e6209a09041d 100644 --- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js +++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js @@ -4,18 +4,20 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) +const { + isBoringSSL, + testSignVerify, + spkiExp, + sec1Exp, +} = require('../common/crypto'); + +if (isBoringSSL) common.skip('BoringSSL does not support paramEncoding: explicit'); const assert = require('assert'); const { generateKeyPair, } = require('crypto'); -const { - testSignVerify, - spkiExp, - sec1Exp, -} = require('../common/crypto'); // Test async explicit elliptic curve key generation, e.g. for ECDSA, // with a SEC1 private key with paramEncoding explicit. diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js index 4c11401d0fc5..ba86fcdb94e3 100644 --- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js +++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js @@ -12,7 +12,7 @@ const { testSignVerify, spkiExp, pkcs8EncExp, - hasOpenSSL3, + hasOpenSSL, } = require('../common/crypto'); // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted @@ -39,7 +39,7 @@ const { // Since the private key is encrypted, signing shouldn't work anymore. assert.throws(() => testSignVerify(publicKey, privateKey), - hasOpenSSL3 ? { + hasOpenSSL(3) ? { message: 'error:07880109:common libcrypto ' + 'routines::interrupted or cancelled' } : { diff --git a/test/parallel/test-crypto-keygen-bit-length.js b/test/parallel/test-crypto-keygen-bit-length.js index 52765f3d7fe7..90d32cd73bc4 100644 --- a/test/parallel/test-crypto-keygen-bit-length.js +++ b/test/parallel/test-crypto-keygen-bit-length.js @@ -4,7 +4,13 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) +const { + isBoringSSL, + hasOpenSSL, + hasFIPS, +} = require('../common/crypto'); + +if (isBoringSSL) common.skip('BoringSSL does not support arbitrary RSA modulus length ' + 'or RSA-PSS/DSA key generation'); @@ -12,7 +18,6 @@ const assert = require('assert'); const { generateKeyPair, } = require('crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); const fips3 = hasFIPS(3); diff --git a/test/parallel/test-crypto-keygen-dh-classic.js b/test/parallel/test-crypto-keygen-dh-classic.js index 13c5db2d0603..a78d068ef79d 100644 --- a/test/parallel/test-crypto-keygen-dh-classic.js +++ b/test/parallel/test-crypto-keygen-dh-classic.js @@ -4,14 +4,15 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) +const { isBoringSSL, hasFIPS } = require('../common/crypto'); + +if (isBoringSSL) common.skip('BoringSSL does not support DH key pair generation'); const assert = require('assert'); const { generateKeyPair, } = require('crypto'); -const { hasFIPS } = require('../common/crypto'); // Test classic Diffie-Hellman key generation. { diff --git a/test/parallel/test-crypto-keygen-eddsa.js b/test/parallel/test-crypto-keygen-eddsa.js index 5dbdf9a7aeea..0f9f8421ce77 100644 --- a/test/parallel/test-crypto-keygen-eddsa.js +++ b/test/parallel/test-crypto-keygen-eddsa.js @@ -8,13 +8,13 @@ const assert = require('assert'); const { generateKeyPair, } = require('crypto'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const rejectsXCurves = hasFIPS(3, 5); // Test EdDSA key generation. { for (const keyType of ['ed25519', 'ed448', 'x25519', 'x448']) { - if (process.features.openssl_is_boringssl && keyType.endsWith('448')) { + if (isBoringSSL && keyType.endsWith('448')) { common.printSkipMessage(`Skipping unsupported ${keyType} test case`); continue; } diff --git a/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js b/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js index 9d1fdf23bc0b..91ace4caff67 100644 --- a/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js +++ b/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js @@ -4,7 +4,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) +const { isBoringSSL, hasFIPS } = require('../common/crypto'); + +if (isBoringSSL) common.skip('BoringSSL does not support DSA key pair generation'); const assert = require('assert'); @@ -12,7 +14,6 @@ const assert = require('assert'); const { generateKeyPairSync, } = require('crypto'); -const { hasFIPS } = require('../common/crypto'); const fips3 = hasFIPS(3); diff --git a/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js b/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js index 778899972863..44243791b38f 100644 --- a/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js +++ b/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js @@ -4,14 +4,15 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) +const { isBoringSSL, hasFIPS } = require('../common/crypto'); + +if (isBoringSSL) common.skip('BoringSSL does not support RSA-PSS key pair generation'); const assert = require('assert'); const { generateKeyPair, } = require('crypto'); -const { hasFIPS } = require('../common/crypto'); // 'rsa-pss' should not add a RSASSA-PSS-params sequence by default. // Regression test for: https://github.com/nodejs/node/issues/39936 diff --git a/test/parallel/test-crypto-keygen-raw.js b/test/parallel/test-crypto-keygen-raw.js index 41ef9362dcac..e748830757f8 100644 --- a/test/parallel/test-crypto-keygen-raw.js +++ b/test/parallel/test-crypto-keygen-raw.js @@ -11,14 +11,14 @@ const { createPublicKey, createPrivateKey, } = require('crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const rejectsXCurves = hasFIPS(3, 5); // Test generateKeyPairSync with raw encoding for EdDSA/ECDH key types. { const types = ['ed25519', 'x25519']; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { types.push('ed448', 'x448'); } for (const type of types) { @@ -59,7 +59,7 @@ const rejectsXCurves = hasFIPS(3, 5); // Test async generateKeyPair with raw encoding for EdDSA/ECDH key types. { const types = ['ed25519', 'x25519']; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { types.push('ed448', 'x448'); } for (const type of types) { @@ -174,7 +174,7 @@ const rejectsXCurves = hasFIPS(3, 5); } // Test error: raw with DSA. -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { assert.throws(() => generateKeyPairSync('dsa', { modulusLength: 2048, publicKeyEncoding: { format: 'raw-public' }, @@ -221,7 +221,7 @@ if (!process.features.openssl_is_boringssl) { } // PQC key types -if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { +if (hasOpenSSL(3, 5) || isBoringSSL) { // Test raw encoding for ML-DSA key types (raw-public + raw-seed only). { for (const type of ['ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87']) { @@ -248,7 +248,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { // Test raw encoding for ML-KEM key types (raw-public + raw-seed only). { for (const type of ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024']) { - if (process.features.openssl_is_boringssl && type === 'ml-kem-512') { + if (isBoringSSL && type === 'ml-kem-512') { common.printSkipMessage(`Skipping unsupported ${type} test case`); continue; } @@ -275,7 +275,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { // Test raw encoding for SLH-DSA key types. { for (const type of ['slh-dsa-sha2-128f', 'slh-dsa-shake-128f']) { - if (process.features.openssl_is_boringssl) { + if (isBoringSSL) { common.printSkipMessage(`Skipping unsupported ${type} test case`); continue; } @@ -290,7 +290,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { } // Test error: raw-seed with SLH-DSA (not supported). - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { assert.throws(() => generateKeyPairSync('slh-dsa-sha2-128f', { publicKeyEncoding: { format: 'raw-public' }, privateKeyEncoding: { format: 'raw-seed' }, diff --git a/test/parallel/test-crypto-keygen-rfc8017-9-1.js b/test/parallel/test-crypto-keygen-rfc8017-9-1.js index 3234084afe10..e1781093c0c2 100644 --- a/test/parallel/test-crypto-keygen-rfc8017-9-1.js +++ b/test/parallel/test-crypto-keygen-rfc8017-9-1.js @@ -4,14 +4,15 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) +const { isBoringSSL, hasFIPS } = require('../common/crypto'); + +if (isBoringSSL) common.skip('BoringSSL does not support RSA-PSS key pair generation'); const assert = require('assert'); const { generateKeyPair, } = require('crypto'); -const { hasFIPS } = require('../common/crypto'); // RFC 8017, 9.1.: "Assuming that the mask generation function is based on a // hash function, it is RECOMMENDED that the hash function be the same as the diff --git a/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js b/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js index f7cb70560e7e..f1543462c394 100644 --- a/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js +++ b/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js @@ -4,14 +4,15 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) +const { isBoringSSL, hasFIPS } = require('../common/crypto'); + +if (isBoringSSL) common.skip('BoringSSL does not support RSA-PSS key pair generation'); const assert = require('assert'); const { generateKeyPair, } = require('crypto'); -const { hasFIPS } = require('../common/crypto'); // RFC 8017, A.2.3.: "For a given hashAlgorithm, the default value of // saltLength is the octet length of the hash value." diff --git a/test/parallel/test-crypto-keygen-rsa-pss.js b/test/parallel/test-crypto-keygen-rsa-pss.js index 88d522a223b9..386db4fe0115 100644 --- a/test/parallel/test-crypto-keygen-rsa-pss.js +++ b/test/parallel/test-crypto-keygen-rsa-pss.js @@ -4,7 +4,14 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) +const { + isBoringSSL, + hasFIPS, + testEncryptDecrypt, + testSignVerify, +} = require('../common/crypto'); + +if (isBoringSSL) common.skip('BoringSSL does not support RSA-PSS key pair generation'); const assert = require('assert'); @@ -12,11 +19,6 @@ const { constants, generateKeyPair, } = require('crypto'); -const { - hasFIPS, - testEncryptDecrypt, - testSignVerify, -} = require('../common/crypto'); // Test RSA-PSS. { diff --git a/test/parallel/test-crypto-keygen.js b/test/parallel/test-crypto-keygen.js index c525a54aa434..a68c7c07c936 100644 --- a/test/parallel/test-crypto-keygen.js +++ b/test/parallel/test-crypto-keygen.js @@ -14,8 +14,11 @@ const { } = require('crypto'); const { inspect } = require('util'); -const { hasOpenSSL3 } = require('../common/crypto'); -const isBoringSSL = process.features.openssl_is_boringssl; +const { + hasOpenSSL, + isBoringSSL: commonIsBoringSSL, +} = require('../common/crypto'); +const isBoringSSL = commonIsBoringSSL; // Test invalid parameter encoding. { @@ -379,7 +382,7 @@ const isBoringSSL = process.features.openssl_is_boringssl; let invalidExponentError = /bad e value/; if (isBoringSSL) { invalidExponentError = /BAD_E_VALUE/; - } else if (hasOpenSSL3) { + } else if (hasOpenSSL(3)) { invalidExponentError = /exponent/; } for (const publicExponent of [1, 1 + 0x10001]) { diff --git a/test/parallel/test-crypto-mac-cache-snapshot.js b/test/parallel/test-crypto-mac-cache-snapshot.js index 1fd37367d2a8..024a4afe8c36 100644 --- a/test/parallel/test-crypto-mac-cache-snapshot.js +++ b/test/parallel/test-crypto-mac-cache-snapshot.js @@ -4,8 +4,8 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL3 } = require('../common/crypto'); -if (!hasOpenSSL3 || process.features.openssl_is_boringssl) +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +if (!hasOpenSSL(3) || isBoringSSL) common.skip('this test requires OpenSSL 3 EVP_MAC support'); const assert = require('node:assert'); diff --git a/test/parallel/test-crypto-mac-cache.js b/test/parallel/test-crypto-mac-cache.js index dfe99e943bb2..a836ef92657e 100644 --- a/test/parallel/test-crypto-mac-cache.js +++ b/test/parallel/test-crypto-mac-cache.js @@ -5,8 +5,8 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL3 } = require('../common/crypto'); -if (!hasOpenSSL3 || process.features.openssl_is_boringssl) +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +if (!hasOpenSSL(3) || isBoringSSL) common.skip('this test requires OpenSSL 3 EVP_MAC support'); const assert = require('node:assert'); diff --git a/test/parallel/test-crypto-mac-errors.js b/test/parallel/test-crypto-mac-errors.js index 43e464bb737e..8bc8cebfcf51 100644 --- a/test/parallel/test-crypto-mac-errors.js +++ b/test/parallel/test-crypto-mac-errors.js @@ -6,9 +6,9 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) { +if (!hasOpenSSL(3) || isBoringSSL) { common.skip('OpenSSL 3 EVP_MAC support is required'); } diff --git a/test/parallel/test-crypto-mac-unsupported.js b/test/parallel/test-crypto-mac-unsupported.js index 68bb79f301e5..1721e9d1c1a7 100644 --- a/test/parallel/test-crypto-mac-unsupported.js +++ b/test/parallel/test-crypto-mac-unsupported.js @@ -6,9 +6,9 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (hasOpenSSL3 && !process.features.openssl_is_boringssl) { +if (hasOpenSSL(3) && !isBoringSSL) { common.skip('this test requires a build without EVP_MAC support'); } diff --git a/test/parallel/test-crypto-mac-vectors.js b/test/parallel/test-crypto-mac-vectors.js index ec9f0cffe877..19544ccf4ec1 100644 --- a/test/parallel/test-crypto-mac-vectors.js +++ b/test/parallel/test-crypto-mac-vectors.js @@ -8,9 +8,9 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) { +if (!hasOpenSSL(3) || isBoringSSL) { common.skip('OpenSSL 3 EVP_MAC support is required'); } diff --git a/test/parallel/test-crypto-mac.js b/test/parallel/test-crypto-mac.js index f41bd86509eb..c275b87a0e6c 100644 --- a/test/parallel/test-crypto-mac.js +++ b/test/parallel/test-crypto-mac.js @@ -8,9 +8,9 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) { +if (!hasOpenSSL(3) || isBoringSSL) { common.skip('OpenSSL 3 EVP_MAC support is required'); } diff --git a/test/parallel/test-crypto-negative-zero.js b/test/parallel/test-crypto-negative-zero.js index 0af9220569c3..0e9525fcaf6c 100644 --- a/test/parallel/test-crypto-negative-zero.js +++ b/test/parallel/test-crypto-negative-zero.js @@ -6,7 +6,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); function getOutcome(fn) { try { @@ -110,7 +110,7 @@ function assertSameErrorOrSuccess(actual, expected) { })); } -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { assert.strictEqual( crypto.createHash('shake128', { outputLength: -0 }).digest('hex'), '', diff --git a/test/parallel/test-crypto-no-algorithm.js b/test/parallel/test-crypto-no-algorithm.js index 90d19ff97fcb..06aab7614ff5 100644 --- a/test/parallel/test-crypto-no-algorithm.js +++ b/test/parallel/test-crypto-no-algorithm.js @@ -4,9 +4,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL } = require('../common/crypto'); -if (!hasOpenSSL3) +if (!hasOpenSSL(3)) common.skip('this test requires OpenSSL 3.x'); const assert = require('node:assert/strict'); diff --git a/test/parallel/test-crypto-oneshot-hash-xof.js b/test/parallel/test-crypto-oneshot-hash-xof.js index 656e7944396e..46b60b22c755 100644 --- a/test/parallel/test-crypto-oneshot-hash-xof.js +++ b/test/parallel/test-crypto-oneshot-hash-xof.js @@ -1,13 +1,15 @@ 'use strict'; + // This tests crypto.hash() works. const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); const crypto = require('crypto'); -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { common.skip('BoringSSL does not support XOF hash functions'); } diff --git a/test/parallel/test-crypto-padding.js b/test/parallel/test-crypto-padding.js index 6e7a7fffee58..dce34409400a 100644 --- a/test/parallel/test-crypto-padding.js +++ b/test/parallel/test-crypto-padding.js @@ -26,7 +26,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL } = require('../common/crypto'); // Input data. const ODD_LENGTH_PLAIN = 'Hello node world!'; @@ -83,7 +83,7 @@ assert.strictEqual(enc(EVEN_LENGTH_PLAIN, true), EVEN_LENGTH_ENCRYPTED); assert.throws(function() { // Input must have block length %. enc(ODD_LENGTH_PLAIN, false); -}, hasOpenSSL3 ? { +}, hasOpenSSL(3) ? { message: /wrong[\s_]final[\s_]block[\s_]length/i, code: /ERR_OSSL(_EVP)?_WRONG_FINAL_BLOCK_LENGTH/, reason: /wrong[\s_]final[\s_]block[\s_]length/i, diff --git a/test/parallel/test-crypto-pqc-encrypted-pkcs8.js b/test/parallel/test-crypto-pqc-encrypted-pkcs8.js index 8f2a10725c94..f4e1d781abc3 100644 --- a/test/parallel/test-crypto-pqc-encrypted-pkcs8.js +++ b/test/parallel/test-crypto-pqc-encrypted-pkcs8.js @@ -4,9 +4,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) +if (!hasOpenSSL(3, 5) && !isBoringSSL) common.skip('requires OpenSSL >= 3.5 or BoringSSL'); const assert = require('assert'); @@ -21,7 +21,7 @@ const algorithms = new Set([ 'ml-kem-512', 'ml-kem-768', 'ml-kem-1024', ]); // BoringSSL does not support ML-KEM-512. -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { algorithms.delete('ml-kem-512'); } diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js index f2a19799c515..cd8f8c926f5b 100644 --- a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js +++ b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js @@ -4,7 +4,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { @@ -100,7 +100,7 @@ for (const [asymmetricKeyType, pubLen] of [ } } - if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) { + if (!hasOpenSSL(3, 5) && !isBoringSSL) { assert.throws(() => createPublicKey(keys.public), { code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM', }); @@ -120,7 +120,7 @@ for (const [asymmetricKeyType, pubLen] of [ [keys.private_seed_only, true, true], [keys.private_priv_only, false, false], ]) { - if (process.features.openssl_is_boringssl && !seedOnly) { + if (isBoringSSL && !seedOnly) { common.printSkipMessage('Skipping unsupported private key format test'); continue; } diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js index 81353b5115dd..d08a479f421c 100644 --- a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js +++ b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js @@ -4,7 +4,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { @@ -100,7 +100,7 @@ for (const [asymmetricKeyType, pubLen] of [ } } - if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) { + if (!hasOpenSSL(3, 5) && !isBoringSSL) { assert.throws(() => createPublicKey(keys.public), { code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM', }); @@ -110,7 +110,7 @@ for (const [asymmetricKeyType, pubLen] of [ code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM', }); } - } else if (process.features.openssl_is_boringssl && asymmetricKeyType === 'ml-kem-512') { + } else if (isBoringSSL && asymmetricKeyType === 'ml-kem-512') { // BoringSSL does not support ML-KEM-512. assert.throws(() => createPublicKey(keys.public), { code: 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM' }); @@ -123,7 +123,7 @@ for (const [asymmetricKeyType, pubLen] of [ assertPublicKey(publicKey); { - const entries = process.features.openssl_is_boringssl ? + const entries = isBoringSSL ? // BoringSSL only supports the seed-only PKCS#8 private key encoding. [[keys.private_seed_only, true]] : [ diff --git a/test/parallel/test-crypto-pqc-keygen-ml-dsa.js b/test/parallel/test-crypto-pqc-keygen-ml-dsa.js index e6534c988c4e..9f9b25bed8b0 100644 --- a/test/parallel/test-crypto-pqc-keygen-ml-dsa.js +++ b/test/parallel/test-crypto-pqc-keygen-ml-dsa.js @@ -4,14 +4,14 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { generateKeyPair, } = require('crypto'); -if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) { +if (!hasOpenSSL(3, 5) && !isBoringSSL) { for (const asymmetricKeyType of ['ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87']) { assert.throws(() => generateKeyPair(asymmetricKeyType, common.mustNotCall()), { code: 'ERR_INVALID_ARG_VALUE', diff --git a/test/parallel/test-crypto-pqc-keygen-ml-kem.js b/test/parallel/test-crypto-pqc-keygen-ml-kem.js index 620f65c3a8d1..bcc5e5996683 100644 --- a/test/parallel/test-crypto-pqc-keygen-ml-kem.js +++ b/test/parallel/test-crypto-pqc-keygen-ml-kem.js @@ -4,19 +4,19 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { generateKeyPair, } = require('crypto'); -const algorithms = process.features.openssl_is_boringssl ? +const algorithms = isBoringSSL ? // BoringSSL does not support ML-KEM-512. ['ml-kem-768', 'ml-kem-1024'] : ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024']; -if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) { +if (!hasOpenSSL(3, 5) && !isBoringSSL) { for (const asymmetricKeyType of ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024']) { assert.throws(() => generateKeyPair(asymmetricKeyType, common.mustNotCall()), { code: 'ERR_INVALID_ARG_VALUE', @@ -72,7 +72,7 @@ if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) { } } -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { assert.throws(() => generateKeyPair('ml-kem-512', common.mustNotCall()), { code: 'ERR_INVALID_ARG_VALUE', message: /The argument 'type' must be a supported key type/ diff --git a/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js b/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js index 535e6a33d5cc..e095269bf610 100644 --- a/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js +++ b/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js @@ -4,9 +4,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) +if (!hasOpenSSL(3, 5) && !isBoringSSL) common.skip('requires OpenSSL >= 3.5 or BoringSSL'); const assert = require('assert'); @@ -39,7 +39,7 @@ for (const [asymmetricKeyType, sigLen] of [ [keys.private_seed_only, true], [keys.private_priv_only, false], ]) { - if (process.features.openssl_is_boringssl && !seedOnly) { + if (isBoringSSL && !seedOnly) { common.printSkipMessage('Skipping unsupported private key format test'); continue; } @@ -52,7 +52,7 @@ for (const [asymmetricKeyType, sigLen] of [ assert.strictEqual(verify(undefined, data, keys.public, Buffer.alloc(sigLen)), false); assert.strictEqual(verify(undefined, data, keys.public, signature), true); assert.strictEqual(verify(undefined, data, privateKey, signature), true); - const code = process.features.openssl_is_boringssl ? + const code = isBoringSSL ? 'ERR_OSSL_EVP_COMMAND_NOT_SUPPORTED' : 'ERR_OSSL_INVALID_DIGEST'; assert.throws(() => sign('sha256', data, privateKey), { code }); assert.throws( @@ -72,7 +72,7 @@ for (const [asymmetricKeyType, sigLen] of [ })); })); - const message = process.features.openssl_is_boringssl ? /COMMAND_NOT_SUPPORTED/ : /invalid digest/; + const message = isBoringSSL ? /COMMAND_NOT_SUPPORTED/ : /invalid digest/; sign('sha256', data, privateKey, common.expectsError(message)); verify('sha256', data, keys.public, Buffer.alloc(sigLen), common.expectsError(message)); } diff --git a/test/parallel/test-crypto-provider-cipher-cache-snapshot.js b/test/parallel/test-crypto-provider-cipher-cache-snapshot.js index 1afc5df8d94d..3ca57279c00f 100644 --- a/test/parallel/test-crypto-provider-cipher-cache-snapshot.js +++ b/test/parallel/test-crypto-provider-cipher-cache-snapshot.js @@ -5,12 +5,12 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL } = require('../common/crypto'); const fixtures = require('../common/fixtures'); const tmpdir = require('../common/tmpdir'); const { buildSnapshot, runWithSnapshot } = require('../common/snapshot'); -if (!hasOpenSSL3) +if (!hasOpenSSL(3)) common.skip('this test requires OpenSSL 3.x'); const entry = fixtures.path('snapshot', 'crypto-provider-cipher-cache.js'); diff --git a/test/parallel/test-crypto-provider-cipher-cache.js b/test/parallel/test-crypto-provider-cipher-cache.js index bde9988480ed..3654ae982435 100644 --- a/test/parallel/test-crypto-provider-cipher-cache.js +++ b/test/parallel/test-crypto-provider-cipher-cache.js @@ -5,8 +5,8 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL3 } = require('../common/crypto'); -if (!hasOpenSSL3) +const { hasOpenSSL } = require('../common/crypto'); +if (!hasOpenSSL(3)) common.skip('this test requires OpenSSL 3.x'); const assert = require('assert'); diff --git a/test/parallel/test-crypto-provider-hash-options.js b/test/parallel/test-crypto-provider-hash-options.js index 609d00d7f7b0..ecccc02f01e4 100644 --- a/test/parallel/test-crypto-provider-hash-options.js +++ b/test/parallel/test-crypto-provider-hash-options.js @@ -3,12 +3,14 @@ const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); + if (!common.hasCrypto) { common.skip('missing crypto'); } if (Number(process.versions.openssl.split('.')[0]) < 4 || - process.features.openssl_is_boringssl) { + isBoringSSL) { common.skip('OpenSSL 4 provider support is required'); } diff --git a/test/parallel/test-crypto-provider-hashes.js b/test/parallel/test-crypto-provider-hashes.js index 166efaa0d7fd..1cf453f9b22b 100644 --- a/test/parallel/test-crypto-provider-hashes.js +++ b/test/parallel/test-crypto-provider-hashes.js @@ -26,9 +26,9 @@ const { sign, verify, } = require('node:crypto'); -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL3 || process.features.openssl_is_boringssl) { +if (!hasOpenSSL(3) || isBoringSSL) { common.skip('OpenSSL 3 provider support is required'); } diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js index bda98652cf59..7c56dcd28dc8 100644 --- a/test/parallel/test-crypto-rsa-dsa.js +++ b/test/parallel/test-crypto-rsa-dsa.js @@ -12,6 +12,7 @@ const fixtures = require('../common/fixtures'); const { hasOpenSSL, hasFIPS, + isBoringSSL, } = require('../common/crypto'); const fips3 = hasFIPS(3); const fips35 = hasFIPS(3, 5); @@ -74,7 +75,7 @@ const openssl1DecryptError = { const decryptError = fips4 ? { code: 'ERR_OSSL_BAD_DECRYPT' } : hasOpenSSL(3) ? { message: 'error:1C800064:Provider routines::bad decrypt' } : - process.features.openssl_is_boringssl ? { + isBoringSSL ? { message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT', code: 'ERR_OSSL_BAD_DECRYPT', reason: 'BAD_DECRYPT', @@ -87,7 +88,7 @@ const decryptPrivateKeyError = fips4 ? { code: 'ERR_OSSL_BAD_DECRYPT', } : hasOpenSSL(3) ? { message: 'error:1C800064:Provider routines::bad decrypt', -} : process.features.openssl_is_boringssl ? { +} : isBoringSSL ? { message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT', } : openssl1DecryptError; @@ -373,7 +374,7 @@ function test_rsa(padding, encryptOaepHash, decryptOaepHash) { test_rsa('RSA_NO_PADDING'); test_rsa('RSA_PKCS1_OAEP_PADDING'); -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { test_rsa('RSA_PKCS1_PADDING'); } else { common.printSkipMessage('Skipping unsupported RSA_PKCS1_PADDING test case'); @@ -548,7 +549,7 @@ assert.throws(() => { // // Test DSA signing and verification // -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { const input = 'I AM THE WALRUS'; // DSA signatures vary across runs so there is no static string to verify @@ -586,7 +587,7 @@ if (!process.features.openssl_is_boringssl) { // // Test DSA signing and verification with PKCS#8 private key // -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { const input = 'I AM THE WALRUS'; // DSA signatures vary across runs so there is no static string to verify @@ -618,7 +619,7 @@ const input = 'I AM THE WALRUS'; }, decryptPrivateKeyError); } -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { // DSA signatures vary across runs so there is no static string to verify // against. const dsaDigest = fips3 ? 'SHA256' : 'SHA1'; diff --git a/test/parallel/test-crypto-scrypt.js b/test/parallel/test-crypto-scrypt.js index 3012a8fa55d5..0f033e05d6d2 100644 --- a/test/parallel/test-crypto-scrypt.js +++ b/test/parallel/test-crypto-scrypt.js @@ -5,7 +5,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const isFips = hasFIPS(3); if (typeof crypto.scrypt !== 'function' || typeof crypto.scryptSync !== 'function') @@ -203,7 +203,7 @@ for (const options of toobig) { const expected = isFips ? { code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS', } : { - message: process.features.openssl_is_boringssl ? + message: isBoringSSL ? /Invalid scrypt params:.*(INVALID_PARAMETERS|MEMORY_LIMIT_EXCEEDED)/ : /Invalid scrypt params:.*memory limit exceeded/, code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS', diff --git a/test/parallel/test-crypto-sec-level.js b/test/parallel/test-crypto-sec-level.js index f2c0e3900624..ff32b29bb2b7 100644 --- a/test/parallel/test-crypto-sec-level.js +++ b/test/parallel/test-crypto-sec-level.js @@ -2,6 +2,8 @@ 'use strict'; const common = require('../common'); + +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); @@ -15,7 +17,7 @@ const assert = require('assert'); // This test simply validates that we can get some value for the secLevel // when needed by tests. const secLevel = require('internal/crypto/util').getOpenSSLSecLevel(); -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { assert.strictEqual(secLevel, 0); } else { assert.ok(secLevel >= 0 && secLevel <= 5); diff --git a/test/parallel/test-crypto-secure-heap.js b/test/parallel/test-crypto-secure-heap.js index 8bd93c5281da..edf4a6d4667f 100644 --- a/test/parallel/test-crypto-secure-heap.js +++ b/test/parallel/test-crypto-secure-heap.js @@ -13,14 +13,19 @@ if (common.isASan) { common.skip('ASan does not play well with secure heap allocations'); } -if (process.features.openssl_is_boringssl) { +const { + isBoringSSL, + hasOpenSSL, + hasFIPS, +} = require('../common/crypto'); + +if (isBoringSSL) { common.skip('BoringSSL does not support secure heap'); } const assert = require('assert'); const { fork } = require('child_process'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); const { secureHeapUsed, createDiffieHellman, diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js index e8398c21bafd..4b874a7e43fb 100644 --- a/test/parallel/test-crypto-sign-verify.js +++ b/test/parallel/test-crypto-sign-verify.js @@ -12,6 +12,7 @@ const { hasOpenSSL, hasFIPS, opensslCli, + isBoringSSL, } = require('../common/crypto'); // Test certificates @@ -80,7 +81,7 @@ if (fips30) { }); }, { message: hasOpenSSL(3) ? 'error:1C8000A5:Provider routines::illegal or unsupported padding mode' : - process.features.openssl_is_boringssl ? + isBoringSSL ? 'error:0600006d:public key routines:OPENSSL_internal:ILLEGAL_OR_UNSUPPORTED_PADDING_MODE' : 'bye, bye, error stack' }); @@ -376,7 +377,7 @@ assert.throws( }, hasOpenSSL(3) ? { code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE', message: /illegal or unsupported padding mode/, - } : process.features.openssl_is_boringssl ? { + } : isBoringSSL ? { code: 'ERR_OSSL_EVP_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE', message: /ILLEGAL_OR_UNSUPPORTED_PADDING_MODE/, } : { @@ -460,7 +461,7 @@ for (const pair of [ raw: true }, { private: fixtures.readKey('ed448_private.pem', 'ascii'), public: fixtures.readKey('ed448_public.pem', 'ascii'), - skip: process.features.openssl_is_boringssl, + skip: isBoringSSL, algo: null, supportsContext: hasOpenSSL(3, 2), sigLen: 114, @@ -721,7 +722,7 @@ MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa const keys = [['ec-key.pem', 64], dsaKey]; for (const [file, length] of keys) { - if (process.features.openssl_is_boringssl && file.startsWith('dsa_')) { + if (isBoringSSL && file.startsWith('dsa_')) { common.printSkipMessage(`Skipping unsupported ${file} test case`); continue; } @@ -857,7 +858,7 @@ if (!opensslCli) { })); } -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { // Test RSA-PSS. { // This key pair does not restrict the message digest algorithm or salt @@ -1022,7 +1023,7 @@ if (!process.features.openssl_is_boringssl) { // Ed25519 and Ed448 must use the one-shot methods const keys = [{ privateKey: fixtures.readKey('ed25519_private.pem', 'ascii'), publicKey: fixtures.readKey('ed25519_public.pem', 'ascii') }]; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { keys.push({ privateKey: fixtures.readKey('ed448_private.pem', 'ascii'), publicKey: fixtures.readKey('ed448_public.pem', 'ascii') }); } else { @@ -1042,7 +1043,7 @@ if (!process.features.openssl_is_boringssl) { } } -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { // Dh, x25519 and x448 should not be used for signing/verifying // https://github.com/nodejs/node/issues/53742 for (const algo of ['dh', 'x25519', 'x448']) { diff --git a/test/parallel/test-crypto-stream.js b/test/parallel/test-crypto-stream.js index ed0916b036a9..9584e48f2cbd 100644 --- a/test/parallel/test-crypto-stream.js +++ b/test/parallel/test-crypto-stream.js @@ -28,7 +28,7 @@ if (!common.hasCrypto) { const assert = require('assert'); const stream = require('stream'); const crypto = require('crypto'); -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); if (!crypto.getFips()) { // Small stream to buffer converter @@ -73,7 +73,7 @@ const cipher = crypto.createCipheriv('aes-128-cbc', key, iv); const decipher = crypto.createDecipheriv('aes-128-cbc', badkey, iv); cipher.pipe(decipher) - .on('error', common.expectsError((hasOpenSSL3 || process.features.openssl_is_boringssl) ? { + .on('error', common.expectsError((hasOpenSSL(3) || isBoringSSL) ? { message: /bad[\s_]decrypt/i, library: /Provider routines|Cipher functions/, reason: /bad[\s_]decrypt/i, diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js index 353699cf9117..c1416fd0703a 100644 --- a/test/parallel/test-crypto-x509.js +++ b/test/parallel/test-crypto-x509.js @@ -19,7 +19,7 @@ const { const assert = require('assert'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const { readFileSync } = require('fs'); const cert = readFileSync(fixtures.path('keys', 'agent1-cert.pem')); @@ -28,8 +28,8 @@ const ca = readFileSync(fixtures.path('keys', 'ca1-cert.pem')); const privateKey = createPrivateKey(key); -if (!process.features.openssl_is_boringssl) { - const expectedPubkeys = hasOpenSSL3 ? [ +if (!isBoringSSL) { + const expectedPubkeys = hasOpenSSL(3) ? [ [ 'rsa_pss_cert_2048.pem', 292, @@ -88,7 +88,7 @@ emailAddress=ry@tinyclouds.org`; let infoAccessCheck = `OCSP - URI:http://ocsp.nodejs.org/ CA Issuers - URI:http://ca.nodejs.org/ca.cert`; -if (!hasOpenSSL3) +if (!hasOpenSSL(3)) infoAccessCheck += '\n'; const der = Buffer.from( @@ -156,7 +156,7 @@ const der = Buffer.from( assert.deepStrictEqual(x509.raw, der); - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { assert.deepStrictEqual(x509.validFromDate, new Date('2022-09-03T21:40:37Z')); assert.deepStrictEqual(x509.validToDate, new Date('2296-06-17T21:40:37Z')); } @@ -399,10 +399,10 @@ tAt3hIKFD1bJt6c6WtMH2Su3syosWxmdmGk5ihslB00lvLpfj/wed8i3bkcB1doq UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0 -----END CERTIFICATE-----`; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { const cert = new X509Certificate(certPem); assert.throws(() => cert.publicKey, { - message: hasOpenSSL3 ? /decode error/ : /wrong tag/, + message: hasOpenSSL(3) ? /decode error/ : /wrong tag/, name: 'Error' }); @@ -446,7 +446,7 @@ UidvpWWipVLZgK+oDks+bKTobcoXGW9oXobiIYqslXPy -----END CERTIFICATE-----`.trim(); const c1 = new X509Certificate(certPemUTCTime); - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { assert.deepStrictEqual(c1.validFromDate, new Date('1949-12-25T23:59:58Z')); assert.deepStrictEqual(c1.validToDate, new Date('1950-01-01T23:59:58Z')); } @@ -483,7 +483,7 @@ CWwQO8JZjJqFtqtuzy2n+gLCvqePgG/gmSqHOPm2ZbLW -----END CERTIFICATE-----`.trim(); const c2 = new X509Certificate(certPemGeneralizedTime); - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { assert.deepStrictEqual(c2.validFromDate, new Date('2049-12-26T00:00:01Z')); assert.deepStrictEqual(c2.validToDate, new Date('2050-01-02T00:00:01Z')); } diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js index 047f051d1e94..3e431c788c62 100644 --- a/test/parallel/test-crypto.js +++ b/test/parallel/test-crypto.js @@ -29,7 +29,7 @@ const assert = require('assert'); const crypto = require('crypto'); const tls = require('tls'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const isFips = hasFIPS(3); // Test Certificates @@ -154,7 +154,7 @@ assert(crypto.getHashes().includes('sha1')); assert(crypto.getHashes().includes('sha256')); assert(!crypto.getHashes().includes('SHA1')); assert(!crypto.getHashes().includes('SHA256')); -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { assert(crypto.getHashes().includes('RSA-SHA1')); assert(!crypto.getHashes().includes('rsa-sha1')); } @@ -230,7 +230,7 @@ assert.throws(() => { assert.throws(() => { throw err; }, { code: 'ERR_OSSL_INVALID_KEY_LENGTH', }); - } else if (process.features.openssl_is_boringssl) { + } else if (isBoringSSL) { // BoringSSL rejects the tiny RSA key while decoding it, before signing. assert.throws(() => { throw err; }, { name: 'Error', @@ -270,7 +270,7 @@ if (!hasOpenSSL(3)) { const sha1_privateKey = fixtures.readKey('rsa_private_pkcs8_bad.pem', 'ascii'); - if (process.features.openssl_is_boringssl) { + if (isBoringSSL) { // BoringSSL accepts the PKCS#8 payload despite the legacy PEM label. const signature = crypto.createSign('sha1').sign(sha1_privateKey); assert(Buffer.isBuffer(signature)); diff --git a/test/parallel/test-https-agent-additional-options.js b/test/parallel/test-https-agent-additional-options.js index 3707855ed5c8..eca5f147a419 100644 --- a/test/parallel/test-https-agent-additional-options.js +++ b/test/parallel/test-https-agent-additional-options.js @@ -6,7 +6,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); const https = require('https'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const fixtures = require('../common/fixtures'); const fips3 = hasFIPS(3); @@ -17,7 +17,7 @@ const options = { minVersion: fips3 ? 'TLSv1.2' : 'TLSv1.1', }; -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { options.ciphers = fips3 ? 'ECDHE-RSA-AES256-GCM-SHA384' : 'ALL@SECLEVEL=0'; } @@ -36,7 +36,7 @@ function getBaseOptions(port) { servername: 'agent1', }; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { baseOptions.ciphers = fips3 ? 'ECDHE-RSA-AES256-GCM-SHA384' : 'ALL@SECLEVEL=0'; } diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js index 971a8f359a6f..c4edc5b33db3 100644 --- a/test/parallel/test-https-agent-session-eviction.js +++ b/test/parallel/test-https-agent-session-eviction.js @@ -8,7 +8,7 @@ if (!common.hasCrypto) { } const fixtures = require('../common/fixtures'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const https = require('https'); const { constants: { SSL_OP_NO_TICKET } } = require('crypto'); @@ -25,7 +25,7 @@ if (fips3) { options.maxVersion = 'TLSv1.3'; } -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { options.ciphers = fips3 ? 'ECDHE-RSA-AES256-GCM-SHA384' : 'RSA@SECLEVEL=0'; } diff --git a/test/parallel/test-https-agent-session-reuse.js b/test/parallel/test-https-agent-session-reuse.js index c5b7b78b8e02..da110e4aeb73 100644 --- a/test/parallel/test-https-agent-session-reuse.js +++ b/test/parallel/test-https-agent-session-reuse.js @@ -1,11 +1,13 @@ 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); const assert = require('assert'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { require('../common/boringssl').testTls13SessionTicketSemanticsDiffer(); return; } diff --git a/test/parallel/test-https-client-renegotiation-limit.js b/test/parallel/test-https-client-renegotiation-limit.js index 729176b7c1aa..ee83c21c8762 100644 --- a/test/parallel/test-https-client-renegotiation-limit.js +++ b/test/parallel/test-https-client-renegotiation-limit.js @@ -20,12 +20,14 @@ // USE OR OTHER DEALINGS IN THE SOFTWARE. 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) { common.skip('missing crypto'); } -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { require('../common/boringssl').testRenegotiationUnsupported(); return; } diff --git a/test/parallel/test-https-options-boolean-check.js b/test/parallel/test-https-options-boolean-check.js index fa02a165b80f..776e966211c7 100644 --- a/test/parallel/test-https-options-boolean-check.js +++ b/test/parallel/test-https-options-boolean-check.js @@ -1,6 +1,8 @@ 'use strict'; const common = require('../common'); + +const { isBoringSSL } = require('../common/crypto'); const fixtures = require('../common/fixtures'); if (!common.hasCrypto) @@ -41,7 +43,7 @@ const certDataView = toDataView(certBuff); const caArrDataView = toDataView(caCert); function filterBoringSSLKeyCertArrayCases(options, setName) { - if (!process.features.openssl_is_boringssl) + if (!isBoringSSL) return options; // The array-valued cases exercise multi-identity key/cert handling. diff --git a/test/parallel/test-permission-openssl-store.js b/test/parallel/test-permission-openssl-store.js index ca2f240a9520..f97657051ca9 100644 --- a/test/parallel/test-permission-openssl-store.js +++ b/test/parallel/test-permission-openssl-store.js @@ -4,8 +4,8 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL3 } = require('../common/crypto'); -if (!hasOpenSSL3) +const { hasOpenSSL } = require('../common/crypto'); +if (!hasOpenSSL(3)) common.skip('requires OpenSSL 3.x'); // Verifies the openssl.store permission: allowed when --allow-openssl-store is diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js index 8349d4c3af6f..f5aeec017964 100644 --- a/test/parallel/test-process-env-allowed-flags-are-documented.js +++ b/test/parallel/test-process-env-allowed-flags-are-documented.js @@ -5,7 +5,7 @@ const common = require('../common'); const assert = require('assert'); const fs = require('fs'); const path = require('path'); -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL } = require('../common/crypto'); const rootDir = path.resolve(__dirname, '..', '..'); const cliMd = path.join(rootDir, 'doc', 'api', 'cli.md'); @@ -44,7 +44,7 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) { } } -if (!hasOpenSSL3) { +if (!hasOpenSSL(3)) { documented.delete('--openssl-legacy-provider'); documented.delete('--openssl-shared-config'); } @@ -63,8 +63,8 @@ const conditionalOpts = [ filter: (opt) => { return [ '--openssl-config', - hasOpenSSL3 ? '--openssl-legacy-provider' : '', - hasOpenSSL3 ? '--openssl-shared-config' : '', + hasOpenSSL(3) ? '--openssl-legacy-provider' : '', + hasOpenSSL(3) ? '--openssl-shared-config' : '', '--tls-cipher-list', '--use-bundled-ca', '--use-openssl-ca', diff --git a/test/parallel/test-process-versions.js b/test/parallel/test-process-versions.js index 14ac88d76cd2..420625b01f59 100644 --- a/test/parallel/test-process-versions.js +++ b/test/parallel/test-process-versions.js @@ -104,12 +104,12 @@ assert.match( assert.match(process.versions.modules, /^\d+$/); if (common.hasCrypto) { - const { hasOpenSSL3 } = require('../common/crypto'); + const { hasOpenSSL } = require('../common/crypto'); assert.match(process.versions.ncrypto, commonTemplate); if (process.config.variables.node_shared_openssl) { assert.ok(process.versions.openssl); } else { - const versionRegex = hasOpenSSL3 ? + const versionRegex = hasOpenSSL(3) ? // The following also matches a development version of OpenSSL 3.x which // can be in the format '3.0.0-alpha4-dev'. This can be handy when // building and linking against the main development branch of OpenSSL. diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js index c319e766ce8a..1b80571e70e6 100644 --- a/test/parallel/test-tls-alert-handling.js +++ b/test/parallel/test-tls-alert-handling.js @@ -6,7 +6,8 @@ if (!common.hasCrypto) { } const { - hasOpenSSL3, + hasOpenSSL, + isBoringSSL, } = require('../common/crypto'); const assert = require('assert'); @@ -38,7 +39,7 @@ const errorHandler = common.mustCall((err) => { assert.match(err.code, /ERR_SSL_(WRONG_VERSION_NUMBER|PACKET_LENGTH_TOO_LONG|BAD_RECORD_TYPE)/); assert.strictEqual(err.library, 'SSL routines'); - if (!hasOpenSSL3 && !process.features.openssl_is_boringssl) + if (!hasOpenSSL(3) && !isBoringSSL) assert.strictEqual(err.function, 'ssl3_get_record'); assert.match(err.reason, /wrong[\s_]version[\s_]number|packet[\s_]length[\s_]too[\s_]long|bad[\s_]record[\s_]type/i); @@ -99,7 +100,7 @@ function sendBADTLSRecord() { assert.match(err.code, /ERR_SSL_(TLSV1_ALERT_PROTOCOL_VERSION|TLSV1_ALERT_RECORD_OVERFLOW|(SSL\/)?TLS_ALERT_UNEXPECTED_MESSAGE)/); assert.strictEqual(err.library, 'SSL routines'); - if (!hasOpenSSL3 && !process.features.openssl_is_boringssl) + if (!hasOpenSSL(3) && !isBoringSSL) assert.strictEqual(err.function, 'ssl3_read_bytes'); assert.match(err.reason, /tlsv1[\s_]alert[\s_]protocol[\s_]version|tlsv1[\s_]alert[\s_]record[\s_]overflow|(ssl\/)?tls[\s_]alert[\s_]unexpected[\s_]message/i); diff --git a/test/parallel/test-tls-alert.js b/test/parallel/test-tls-alert.js index f20bf42a2dcd..5c229d7e05cd 100644 --- a/test/parallel/test-tls-alert.js +++ b/test/parallel/test-tls-alert.js @@ -29,6 +29,7 @@ const { hasOpenSSL, hasFIPS, opensslCli, + isBoringSSL, } = require('../common/crypto'); if (!opensslCli) { @@ -56,7 +57,7 @@ if (hasFIPS(3)) { } const server = tls.Server(serverOptions, null).listen(0, common.mustCall(() => { - if (process.features.openssl_is_boringssl) { + if (isBoringSSL) { let gotClientError = false; let gotServerError = false; function maybeClose() { diff --git a/test/parallel/test-tls-cert-ext-encoding.js b/test/parallel/test-tls-cert-ext-encoding.js index 154e0cdcf022..973e9fad32ee 100644 --- a/test/parallel/test-tls-cert-ext-encoding.js +++ b/test/parallel/test-tls-cert-ext-encoding.js @@ -3,9 +3,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL } = require('../common/crypto'); -if (hasOpenSSL3) +if (hasOpenSSL(3)) // TODO(danbev) This test fails with the following error: // error:0D00008F:asn1 encoding routines::no matching choice type // diff --git a/test/parallel/test-tls-client-auth.js b/test/parallel/test-tls-client-auth.js index 517054c6e290..da06156e2e07 100644 --- a/test/parallel/test-tls-client-auth.js +++ b/test/parallel/test-tls-client-auth.js @@ -6,7 +6,7 @@ const fixtures = require('../common/fixtures'); if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const { assert, connect, keys, tls @@ -111,7 +111,7 @@ if (tls.DEFAULT_MAX_VERSION === 'TLSv1.3') connect({ // and sends a fatal Alert to the client that the client discovers there has // been a fatal error. pair.client.conn.once('error', common.mustCall((err) => { - const expectedErr = process.features.openssl_is_boringssl ? + const expectedErr = isBoringSSL ? 'ERR_SSL_TLSV1_ALERT_CERTIFICATE_REQUIRED' : 'ERR_SSL_TLSV13_ALERT_CERTIFICATE_REQUIRED'; assert.strictEqual(err.code, expectedErr); diff --git a/test/parallel/test-tls-client-getephemeralkeyinfo.js b/test/parallel/test-tls-client-getephemeralkeyinfo.js index 638df3ff0141..f1c179db8fae 100644 --- a/test/parallel/test-tls-client-getephemeralkeyinfo.js +++ b/test/parallel/test-tls-client-getephemeralkeyinfo.js @@ -3,13 +3,18 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) { +const { + isBoringSSL, + hasOpenSSL, + hasFIPS, +} = require('../common/crypto'); + +if (isBoringSSL) { require('../common/boringssl').testEphemeralKeyInfo(); return; } const fixtures = require('../common/fixtures'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); const assert = require('assert'); const { X509Certificate } = require('crypto'); diff --git a/test/parallel/test-tls-client-mindhsize.js b/test/parallel/test-tls-client-mindhsize.js index 8f3b2eafbb8a..f08be448dd19 100644 --- a/test/parallel/test-tls-client-mindhsize.js +++ b/test/parallel/test-tls-client-mindhsize.js @@ -13,7 +13,7 @@ const secLevel = require('internal/crypto/util').getOpenSSLSecLevel(); const assert = require('assert'); const tls = require('tls'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const fips3 = hasFIPS(3); const fips4 = hasFIPS(4); @@ -88,7 +88,7 @@ function testDHE3072() { test(3072, false, null); } -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { if (fips3 && !fips4) { // The FIPS provider rejects explicit DH parameters without a validated // subgroup, while OpenSSL's built-in FFDHE group remains available. @@ -129,7 +129,7 @@ for (const minDHSize of [true, false, null, undefined, {}, [], '', '1']) { }); } -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { process.on('exit', function() { assert.strictEqual(nsuccess, 1); assert.strictEqual(nerror, 1); diff --git a/test/parallel/test-tls-client-reject.js b/test/parallel/test-tls-client-reject.js index cff0aabc89a7..90e3127ba471 100644 --- a/test/parallel/test-tls-client-reject.js +++ b/test/parallel/test-tls-client-reject.js @@ -20,7 +20,9 @@ // USE OR OTHER DEALINGS IN THE SOFTWARE. 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); @@ -31,7 +33,7 @@ const fixtures = require('../common/fixtures'); const options = { key: fixtures.readKey('rsa_private.pem'), cert: fixtures.readKey('rsa_cert.crt'), - ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}), + ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}), }; const server = tls.createServer(options, function(socket) { @@ -48,7 +50,7 @@ function unauthorized() { port: server.address().port, servername: 'localhost', rejectUnauthorized: false, - ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}), + ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}), }, common.mustCall(function() { let _data; assert(!socket.authorized); @@ -70,7 +72,7 @@ function rejectUnauthorized() { console.log('reject unauthorized'); const socket = tls.connect(server.address().port, { servername: 'localhost', - ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}), + ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}), }, common.mustNotCall()); socket.on('data', common.mustNotCall()); socket.on('error', common.mustCall(function(err) { @@ -84,7 +86,7 @@ function rejectUnauthorizedUndefined() { const socket = tls.connect(server.address().port, { servername: 'localhost', rejectUnauthorized: undefined, - ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}), + ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}), }, common.mustNotCall()); socket.on('data', common.mustNotCall()); socket.on('error', common.mustCall(function(err) { @@ -98,7 +100,7 @@ function authorized() { const socket = tls.connect(server.address().port, { ca: [fixtures.readKey('rsa_cert.crt')], servername: 'localhost', - ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}), + ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}), }, common.mustCall(function() { console.log('... authorized'); assert(socket.authorized); diff --git a/test/parallel/test-tls-client-renegotiation-13.js b/test/parallel/test-tls-client-renegotiation-13.js index 80c4753d065e..33e74af13eda 100644 --- a/test/parallel/test-tls-client-renegotiation-13.js +++ b/test/parallel/test-tls-client-renegotiation-13.js @@ -5,7 +5,7 @@ const common = require('../common'); if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const fixtures = require('../common/fixtures'); @@ -32,7 +32,7 @@ connect({ assert.strictEqual(client.getProtocol(), 'TLSv1.3'); const ok = client.renegotiate({}, common.mustCall((err) => { - if (process.features.openssl_is_boringssl) { + if (isBoringSSL) { assert.throws(() => { throw err; }, { message: 'TLS session renegotiation is unsupported by this TLS ' + 'implementation', @@ -40,7 +40,7 @@ connect({ }); } else { assert.throws(() => { throw err; }, { - message: hasOpenSSL3 ? + message: hasOpenSSL(3) ? 'error:0A00010A:SSL routines::wrong ssl version' : 'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version', code: 'ERR_SSL_WRONG_SSL_VERSION', diff --git a/test/parallel/test-tls-client-renegotiation-limit.js b/test/parallel/test-tls-client-renegotiation-limit.js index 9b7f62865b33..b712e6f7d9eb 100644 --- a/test/parallel/test-tls-client-renegotiation-limit.js +++ b/test/parallel/test-tls-client-renegotiation-limit.js @@ -25,13 +25,13 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { opensslCli } = require('../common/crypto'); +const { opensslCli, isBoringSSL } = require('../common/crypto'); if (!opensslCli) { common.skip('node compiled without OpenSSL CLI.'); } -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { require('../common/boringssl').testRenegotiationUnsupported(); return; } diff --git a/test/parallel/test-tls-dhe.js b/test/parallel/test-tls-dhe.js index 65f3dc6867c4..6f54bbd97667 100644 --- a/test/parallel/test-tls-dhe.js +++ b/test/parallel/test-tls-dhe.js @@ -26,7 +26,9 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -if (process.features.openssl_is_boringssl) { +const { isBoringSSL } = require('../common/crypto'); + +if (isBoringSSL) { require('../common/boringssl').assertFiniteFieldDheUnsupported(); return; } diff --git a/test/parallel/test-tls-dhparam-auto-boringssl.js b/test/parallel/test-tls-dhparam-auto-boringssl.js index 54f2190d1a94..d2334c7feb0e 100644 --- a/test/parallel/test-tls-dhparam-auto-boringssl.js +++ b/test/parallel/test-tls-dhparam-auto-boringssl.js @@ -1,9 +1,11 @@ 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); -if (!process.features.openssl_is_boringssl) +if (!isBoringSSL) common.skip('only applies to BoringSSL builds'); const assert = require('assert'); diff --git a/test/parallel/test-tls-disable-renegotiation.js b/test/parallel/test-tls-disable-renegotiation.js index 84a6ead4a544..1934becc2a62 100644 --- a/test/parallel/test-tls-disable-renegotiation.js +++ b/test/parallel/test-tls-disable-renegotiation.js @@ -1,5 +1,7 @@ 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const fixtures = require('../common/fixtures'); @@ -8,7 +10,7 @@ const fixtures = require('../common/fixtures'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { require('../common/boringssl').testRenegotiationUnsupported(); return; } diff --git a/test/parallel/test-tls-ecdh-multiple.js b/test/parallel/test-tls-ecdh-multiple.js index b01051d5b457..cc74130a2e39 100644 --- a/test/parallel/test-tls-ecdh-multiple.js +++ b/test/parallel/test-tls-ecdh-multiple.js @@ -12,6 +12,7 @@ const { opensslCli, hasOpenSSL, hasFIPS, + isBoringSSL, } = require('../common/crypto'); const crypto = require('crypto'); @@ -31,7 +32,7 @@ function loadPEM(n) { // The FIPS provider and OpenSSL 4.0 disable support for deprecated elliptic // curves from RFC 8422 (including secp256k1) by default. -const ecdhCurve = process.features.openssl_is_boringssl || +const ecdhCurve = isBoringSSL || hasOpenSSL(4, 0) || hasFIPS(3) ? 'prime256v1:secp521r1' : 'secp256k1:prime256v1:secp521r1'; @@ -82,7 +83,7 @@ const server = tls.createServer(options, (conn) => { } // Deprecated RFC 8422 curves are disabled by default in OpenSSL 4.0. - if (process.features.openssl_is_boringssl || hasOpenSSL(4, 0)) { + if (isBoringSSL || hasOpenSSL(4, 0)) { unsupportedCurves.push('secp256k1'); } diff --git a/test/parallel/test-tls-empty-sni-context.js b/test/parallel/test-tls-empty-sni-context.js index 6ecdfbeecbe3..7d8bf61239ac 100644 --- a/test/parallel/test-tls-empty-sni-context.js +++ b/test/parallel/test-tls-empty-sni-context.js @@ -3,7 +3,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const tls = require('tls'); @@ -26,7 +26,7 @@ const server = tls.createServer(options, (c) => { }, common.mustNotCall()); c.on('error', common.mustCall((err) => { - const expectedErr = process.features.openssl_is_boringssl ? + const expectedErr = isBoringSSL ? 'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR' : hasOpenSSL(4, 0) ? 'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ? 'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE'; diff --git a/test/parallel/test-tls-finished.js b/test/parallel/test-tls-finished.js index b23b4567d27e..5a33257cebc1 100644 --- a/test/parallel/test-tls-finished.js +++ b/test/parallel/test-tls-finished.js @@ -1,6 +1,8 @@ 'use strict'; const common = require('../common'); + +const { isBoringSSL } = require('../common/crypto'); const fixtures = require('../common/fixtures'); if (!common.hasCrypto) @@ -21,7 +23,7 @@ const pem = (n) => fixtures.readKey(`${n}.pem`); const server = tls.createServer({ key: pem('agent1-key'), cert: pem('agent1-cert'), - ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}), + ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}), }, common.mustCall((alice) => { msg.server = { alice: alice.getFinished(), @@ -34,7 +36,7 @@ server.listen(0, common.mustCall(() => { const bob = tls.connect({ port: server.address().port, rejectUnauthorized: false, - ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}), + ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}), }, common.mustCall(() => { msg.client = { alice: bob.getPeerFinished(), diff --git a/test/parallel/test-tls-getcipher.js b/test/parallel/test-tls-getcipher.js index 2d4de5639afb..cb8f1ba826b5 100644 --- a/test/parallel/test-tls-getcipher.js +++ b/test/parallel/test-tls-getcipher.js @@ -20,7 +20,9 @@ // USE OR OTHER DEALINGS IN THE SOFTWARE. 'use strict'; + const common = require('../common'); +const { isBoringSSL: commonIsBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); @@ -36,7 +38,7 @@ const options = { honorCipherOrder: true }; -const isBoringSSL = process.features.openssl_is_boringssl; +const isBoringSSL = commonIsBoringSSL; let clients = 0; const expectedClients = isBoringSSL ? 1 : 2; const server = tls.createServer(options, common.mustCall(() => { diff --git a/test/parallel/test-tls-getprotocol.js b/test/parallel/test-tls-getprotocol.js index 2fe971444271..e3e0a1fa2418 100644 --- a/test/parallel/test-tls-getprotocol.js +++ b/test/parallel/test-tls-getprotocol.js @@ -3,7 +3,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); // This test ensures that `getProtocol` returns the right protocol // from a TLS connection @@ -28,7 +28,7 @@ let clientConfigs = [ }, ]; -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { // Remove the TLSv1 and TLSv1.1 cases. BoringSSL does not negotiate those // legacy protocols in this configuration; keep TLSv1.2 to cover getProtocol() // on a successful BoringSSL TLS handshake. @@ -42,7 +42,7 @@ const serverConfig = { cert: fixtures.readKey('agent2-cert.pem') }; -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { serverConfig.ciphers = fips3 ? 'ECDHE-RSA-AES256-GCM-SHA384' : 'RSA@SECLEVEL=0'; } diff --git a/test/parallel/test-tls-honorcipherorder.js b/test/parallel/test-tls-honorcipherorder.js index fbee483d83b9..fcaed53353a8 100644 --- a/test/parallel/test-tls-honorcipherorder.js +++ b/test/parallel/test-tls-honorcipherorder.js @@ -8,7 +8,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const mustCall = common.mustCall; const tls = require('tls'); const util = require('util'); @@ -17,7 +17,7 @@ const util = require('util'); // default method is updated in the future const SSL_Method = 'TLSv1_2_method'; const localhost = '127.0.0.1'; -const config = process.features.openssl_is_boringssl || hasFIPS(3) ? { +const config = isBoringSSL || hasFIPS(3) ? { serverCiphers: 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256', clientPreferenceCiphers: diff --git a/test/parallel/test-tls-key-mismatch.js b/test/parallel/test-tls-key-mismatch.js index 797c7c171dc5..8f60ef0520c4 100644 --- a/test/parallel/test-tls-key-mismatch.js +++ b/test/parallel/test-tls-key-mismatch.js @@ -27,13 +27,13 @@ if (!common.hasCrypto) { } const fixtures = require('../common/fixtures'); -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const tls = require('tls'); -const errorMessageRegex = process.features.openssl_is_boringssl ? +const errorMessageRegex = isBoringSSL ? /^Error: error:0b000074:X\.509 certificate routines:OPENSSL_internal:KEY_VALUES_MISMATCH$/ : - hasOpenSSL3 ? + hasOpenSSL(3) ? /^Error: error:05800074:x509 certificate routines::key values mismatch$/ : /^Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch$/; diff --git a/test/parallel/test-tls-legacy-pfx.js b/test/parallel/test-tls-legacy-pfx.js index 5106217718db..77f9c0935025 100644 --- a/test/parallel/test-tls-legacy-pfx.js +++ b/test/parallel/test-tls-legacy-pfx.js @@ -4,9 +4,9 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL } = require('../common/crypto'); -if (!hasOpenSSL3) { +if (!hasOpenSSL(3)) { common.skip('OpenSSL legacy failures are only testable with OpenSSL 3+'); } diff --git a/test/parallel/test-tls-max-send-fragment.js b/test/parallel/test-tls-max-send-fragment.js index 2e319fcdaeaf..d389cf50d3d7 100644 --- a/test/parallel/test-tls-max-send-fragment.js +++ b/test/parallel/test-tls-max-send-fragment.js @@ -20,7 +20,9 @@ // USE OR OTHER DEALINGS IN THE SOFTWARE. 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); const fixtures = require('../common/fixtures'); if (!common.hasCrypto) @@ -64,7 +66,7 @@ const server = tls.createServer({ // both out-of-range values and reports success, so assert that difference // explicitly instead of using a truthiness shortcut. const acceptsOutOfRangeFragmentSize = - process.features.openssl_is_boringssl; + isBoringSSL; assert.strictEqual(c.setMaxSendFragment(511), acceptsOutOfRangeFragmentSize); assert.strictEqual(c.setMaxSendFragment(16385), diff --git a/test/parallel/test-tls-min-max-version.js b/test/parallel/test-tls-min-max-version.js index 83797238cf4b..932ad7f0f219 100644 --- a/test/parallel/test-tls-min-max-version.js +++ b/test/parallel/test-tls-min-max-version.js @@ -5,15 +5,17 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -if (process.features.openssl_is_boringssl) { - require('../common/boringssl').testLegacyProtocolUnsupported(); - return; -} - const { + isBoringSSL, hasOpenSSL, hasFIPS, } = require('../common/crypto'); + +if (isBoringSSL) { + require('../common/boringssl').testLegacyProtocolUnsupported(); + return; +} + const fixtures = require('../common/fixtures'); const { inspect } = require('util'); diff --git a/test/parallel/test-tls-multi-key.js b/test/parallel/test-tls-multi-key.js index 239cb8aec725..cc52eb9e65d4 100644 --- a/test/parallel/test-tls-multi-key.js +++ b/test/parallel/test-tls-multi-key.js @@ -27,7 +27,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) { +const { isBoringSSL, hasFIPS } = require('../common/crypto'); + +if (isBoringSSL) { require('../common/boringssl').assertMultiKeyUnsupported(); return; } @@ -35,7 +37,6 @@ if (process.features.openssl_is_boringssl) { const fixtures = require('../common/fixtures'); const assert = require('assert'); const tls = require('tls'); -const { hasFIPS } = require('../common/crypto'); // Key is ordered as ec, rsa, cert is ordered as rsa, ec. test({ diff --git a/test/parallel/test-tls-multi-pfx.js b/test/parallel/test-tls-multi-pfx.js index b5bbb6decc12..d8a533049b2e 100644 --- a/test/parallel/test-tls-multi-pfx.js +++ b/test/parallel/test-tls-multi-pfx.js @@ -3,14 +3,15 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) { +const { isBoringSSL, hasFIPS } = require('../common/crypto'); + +if (isBoringSSL) { require('../common/boringssl').testMultiPfxSelectionDifference(); return; } const assert = require('assert'); const tls = require('tls'); -const { hasFIPS } = require('../common/crypto'); const fixtures = require('../common/fixtures'); const fips3 = hasFIPS(3); const fips4 = hasFIPS(4); diff --git a/test/parallel/test-tls-no-cert-required.js b/test/parallel/test-tls-no-cert-required.js index 499ab2dfd14e..36da97526b6b 100644 --- a/test/parallel/test-tls-no-cert-required.js +++ b/test/parallel/test-tls-no-cert-required.js @@ -20,7 +20,9 @@ // USE OR OTHER DEALINGS IN THE SOFTWARE. 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); @@ -28,7 +30,7 @@ const assert = require('assert'); const tls = require('tls'); // Omitting the cert or pfx option to tls.createServer() should not throw. -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { // AECDH-NULL-SHA is a no-authentication/no-encryption cipher and hence // does not need a certificate. BoringSSL does not provide that anonymous // cipher suite, so only this cipher-specific no-cert case is skipped. diff --git a/test/parallel/test-tls-options-boolean-check.js b/test/parallel/test-tls-options-boolean-check.js index f7dd7bb102f3..4366502aacb3 100644 --- a/test/parallel/test-tls-options-boolean-check.js +++ b/test/parallel/test-tls-options-boolean-check.js @@ -1,6 +1,8 @@ 'use strict'; const common = require('../common'); + +const { isBoringSSL } = require('../common/crypto'); const fixtures = require('../common/fixtures'); if (!common.hasCrypto) @@ -41,7 +43,7 @@ const certDataView = toDataView(certBuff); const caArrDataView = toDataView(caCert); function filterBoringSSLKeyCertArrayCases(options, setName) { - if (!process.features.openssl_is_boringssl) + if (!isBoringSSL) return options; // The array-valued cases exercise multi-identity key/cert handling. diff --git a/test/parallel/test-tls-psk-alpn-callback-exception-handling.js b/test/parallel/test-tls-psk-alpn-callback-exception-handling.js index 0ba55f9153b9..0045517b0224 100644 --- a/test/parallel/test-tls-psk-alpn-callback-exception-handling.js +++ b/test/parallel/test-tls-psk-alpn-callback-exception-handling.js @@ -10,11 +10,12 @@ // throw exceptions during validation. const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { require('../common/boringssl').testPskTls13Unsupported(); return; } diff --git a/test/parallel/test-tls-psk-circuit.js b/test/parallel/test-tls-psk-circuit.js index c9c93d533501..8a0115a76125 100644 --- a/test/parallel/test-tls-psk-circuit.js +++ b/test/parallel/test-tls-psk-circuit.js @@ -5,12 +5,13 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -if (process.features.openssl_is_boringssl) { +const { isBoringSSL, hasOpenSSL } = require('../common/crypto'); + +if (isBoringSSL) { require('../common/boringssl').testPskTls13Unsupported(); return; } -const { hasOpenSSL } = require('../common/crypto'); const assert = require('assert'); const tls = require('tls'); diff --git a/test/parallel/test-tls-psk-server.js b/test/parallel/test-tls-psk-server.js index 692550fc1c19..29d164f019da 100644 --- a/test/parallel/test-tls-psk-server.js +++ b/test/parallel/test-tls-psk-server.js @@ -5,7 +5,9 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -if (process.features.openssl_is_boringssl) { +const { isBoringSSL } = require('../common/crypto'); + +if (isBoringSSL) { require('../common/boringssl').testPskTls13Unsupported(); return; } diff --git a/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js b/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js index cca22067a0fe..b013d9f02c7a 100644 --- a/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js +++ b/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js @@ -1,10 +1,12 @@ 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { require('../common/boringssl').assertOpenSSLSecurityLevelsUnsupported(); return; } diff --git a/test/parallel/test-tls-server-verify.js b/test/parallel/test-tls-server-verify.js index 439e32131030..c7487f593eb7 100644 --- a/test/parallel/test-tls-server-verify.js +++ b/test/parallel/test-tls-server-verify.js @@ -26,7 +26,7 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -const { opensslCli } = require('../common/crypto'); +const { opensslCli, isBoringSSL } = require('../common/crypto'); if (!opensslCli) { common.skip('node compiled without OpenSSL CLI.'); @@ -125,7 +125,7 @@ let testCases = ] }, ]; -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { // Remove the delayed client-certificate verification case. It depends on TLS // renegotiation to request a client certificate after the initial handshake, // but BoringSSL does not support caller-initiated renegotiation. diff --git a/test/parallel/test-tls-session-cache.js b/test/parallel/test-tls-session-cache.js index 0789879e1dce..54b7eeca2e9b 100644 --- a/test/parallel/test-tls-session-cache.js +++ b/test/parallel/test-tls-session-cache.js @@ -28,6 +28,7 @@ const { hasOpenSSL, hasFIPS, opensslCli, + isBoringSSL: commonIsBoringSSL, } = require('../common/crypto'); if (!opensslCli) { @@ -38,7 +39,7 @@ const fixtures = require('../common/fixtures'); const assert = require('assert'); const tls = require('tls'); const { spawn } = require('child_process'); -const isBoringSSL = process.features.openssl_is_boringssl; +const isBoringSSL = commonIsBoringSSL; doTest({ tickets: false }, function() { doTest({ tickets: true }, function() { diff --git a/test/parallel/test-tls-set-ciphers-error.js b/test/parallel/test-tls-set-ciphers-error.js index b79bd512ffe1..102186f9e399 100644 --- a/test/parallel/test-tls-set-ciphers-error.js +++ b/test/parallel/test-tls-set-ciphers-error.js @@ -7,7 +7,7 @@ if (!common.hasCrypto) const assert = require('assert'); const tls = require('tls'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); { const options = { @@ -21,7 +21,7 @@ const { hasOpenSSL } = require('../common/crypto'); assert.throws(() => tls.createServer(options, common.mustNotCall()), /no[_ ]cipher[_ ]match/i); options.ciphers = 'TLS_not_a_cipher'; - if (process.features.openssl_is_boringssl) { + if (isBoringSSL) { tls.createServer(options).close(); } else { assert.throws(() => tls.createServer(options, common.mustNotCall()), diff --git a/test/parallel/test-tls-set-default-ca-certificates-recovery.js b/test/parallel/test-tls-set-default-ca-certificates-recovery.js index ea6f98d5686e..d4154a2da62e 100644 --- a/test/parallel/test-tls-set-default-ca-certificates-recovery.js +++ b/test/parallel/test-tls-set-default-ca-certificates-recovery.js @@ -3,6 +3,7 @@ // This tests error recovery and fallback behavior for tls.setDefaultCACertificates() const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); @@ -27,7 +28,7 @@ function testRecovery(expectedCerts) { { const invalidCert = '-----BEGIN CERTIFICATE-----\nvalid cert content\n-----END CERTIFICATE-----'; assert.throws(() => tls.setDefaultCACertificates([fixtureCert, invalidCert]), { - code: process.features.openssl_is_boringssl ? + code: isBoringSSL ? 'ERR_OSSL_PEM_ASN.1_ENCODING_ROUTINES' : 'ERR_OSSL_PEM_ASN1_LIB', }); diff --git a/test/parallel/test-tls-set-sigalgs.js b/test/parallel/test-tls-set-sigalgs.js index e1bf8b93f8a3..ca111e83ef2b 100644 --- a/test/parallel/test-tls-set-sigalgs.js +++ b/test/parallel/test-tls-set-sigalgs.js @@ -3,7 +3,7 @@ const common = require('../common'); if (!common.hasCrypto) { common.skip('missing crypto'); } -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const fixtures = require('../common/fixtures'); // Test sigalgs: option for TLS. @@ -41,7 +41,7 @@ function test(csigalgs, ssigalgs, shared_sigalgs, cerr, serr) { assert(pair.client.conn); // BoringSSL's OpenSSL-compatible SSL_get_shared_sigalgs() API always // returns zero, so a successful handshake still reports an empty list. - const expectedSharedSigalgs = process.features.openssl_is_boringssl ? + const expectedSharedSigalgs = isBoringSSL ? [] : shared_sigalgs; assert.deepStrictEqual( @@ -74,7 +74,7 @@ test('RSA-PSS+SHA256:RSA-PSS+SHA512:ECDSA+SHA256', const handshakeErr = hasOpenSSL(4, 0) ? 'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ? 'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE'; -const noSharedSigalgsErr = process.features.openssl_is_boringssl ? +const noSharedSigalgsErr = isBoringSSL ? 'ERR_SSL_NO_COMMON_SIGNATURE_ALGORITHMS' : 'ERR_SSL_NO_SHARED_SIGNATURE_ALGORITHMS'; test('RSA-PSS+SHA384', 'ECDSA+SHA256', diff --git a/test/parallel/test-tls-ticket-cluster.js b/test/parallel/test-tls-ticket-cluster.js index f183b53f24c0..fa3c23c2a6e2 100644 --- a/test/parallel/test-tls-ticket-cluster.js +++ b/test/parallel/test-tls-ticket-cluster.js @@ -20,11 +20,13 @@ // USE OR OTHER DEALINGS IN THE SOFTWARE. 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { require('../common/boringssl').testTls13SessionTicketSemanticsDiffer(); return; } diff --git a/test/parallel/test-tls-ticket.js b/test/parallel/test-tls-ticket.js index 8316f5e8da8d..b6aa7a6de9c3 100644 --- a/test/parallel/test-tls-ticket.js +++ b/test/parallel/test-tls-ticket.js @@ -20,7 +20,9 @@ // USE OR OTHER DEALINGS IN THE SOFTWARE. 'use strict'; + const common = require('../common'); +const { isBoringSSL } = require('../common/crypto'); if (!common.hasCrypto) common.skip('missing crypto'); @@ -30,7 +32,7 @@ const net = require('net'); const crypto = require('crypto'); const fixtures = require('../common/fixtures'); -if (process.features.openssl_is_boringssl && +if (isBoringSSL && tls.DEFAULT_MAX_VERSION !== 'TLSv1.2') { require('../common/boringssl').testTls13SessionTicketSemanticsDiffer(); return; diff --git a/test/parallel/test-tls-write-error.js b/test/parallel/test-tls-write-error.js index f6ec7b9bd245..08b943aab713 100644 --- a/test/parallel/test-tls-write-error.js +++ b/test/parallel/test-tls-write-error.js @@ -7,7 +7,7 @@ const { TestTLSSocket, ccs } = require('../common/tls'); const fixtures = require('../common/fixtures'); const assert = require('assert'); const https = require('https'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); // Regression test for an use-after-free bug in the TLS implementation that // would occur when `SSL_write()` failed. @@ -22,7 +22,7 @@ const opts = { }; const rejectsClientHello = hasFIPS(3) && !hasFIPS(3, 5); -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { opts.ciphers = 'ALL@SECLEVEL=0'; } diff --git a/test/parallel/test-trace-env.js b/test/parallel/test-trace-env.js index 7a7b80fa4c10..4d1a8165277e 100644 --- a/test/parallel/test-trace-env.js +++ b/test/parallel/test-trace-env.js @@ -19,8 +19,8 @@ spawnSyncAndAssert(process.execPath, ['--trace-env', fixtures.path('empty.js')], if (common.hasCrypto) { assert.match(output, /get "NODE_EXTRA_CA_CERTS"/); - const { hasOpenSSL3 } = require('../common/crypto'); - if (hasOpenSSL3) { + const { hasOpenSSL } = require('../common/crypto'); + if (hasOpenSSL(3)) { assert.match(output, /get "OPENSSL_CONF"/); } } diff --git a/test/parallel/test-webcrypto-crypto-job-mode.js b/test/parallel/test-webcrypto-crypto-job-mode.js index 327c6a6f154c..5f5f1761a4c7 100644 --- a/test/parallel/test-webcrypto-crypto-job-mode.js +++ b/test/parallel/test-webcrypto-crypto-job-mode.js @@ -7,7 +7,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const { types: { isCryptoKey } } = require('util'); const { internalBinding } = require('internal/test/binding'); const { @@ -211,7 +211,7 @@ async function withObjectPrototypeSetters(names, fn) { } } - if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { + if (hasOpenSSL(3, 5) || isBoringSSL) { const pair = await subtle.generateKey( { name: 'ML-KEM-768' }, true, diff --git a/test/parallel/test-webcrypto-deduplicate-usages.js b/test/parallel/test-webcrypto-deduplicate-usages.js index d27675d873ce..1d7247644abd 100644 --- a/test/parallel/test-webcrypto-deduplicate-usages.js +++ b/test/parallel/test-webcrypto-deduplicate-usages.js @@ -13,7 +13,7 @@ if (!common.hasCrypto) const assert = require('assert'); const { createSecretKey } = require('crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const { subtle } = globalThis.crypto; function assertSameSet(actual, expected, msg) { @@ -115,7 +115,7 @@ function assertSameSet(actual, expected, msg) { asymmetric.splice(asymmetric.findIndex(({ algorithm }) => algorithm.name === 'X25519'), 1); - if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { + if (hasOpenSSL(3, 5) || isBoringSSL) { asymmetric.push({ algorithm: { name: 'ML-DSA-65' }, usages: ['verify', 'sign', 'verify', 'sign'], @@ -297,7 +297,7 @@ function assertSameSet(actual, expected, msg) { assert.deepStrictEqual(imported.usages, ['sign']); })()); - if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { + if (hasOpenSSL(3, 5) || isBoringSSL) { // ML-DSA JWK roundtrip. tests.push((async () => { const { privateKey } = await subtle.generateKey( @@ -508,7 +508,7 @@ function assertSameSet(actual, expected, msg) { jwkPairVectors.splice(jwkPairVectors.findIndex(({ algorithm }) => algorithm.name === 'X25519'), 1); - if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { + if (hasOpenSSL(3, 5) || isBoringSSL) { jwkPairVectors.push({ algorithm: { name: 'ML-DSA-65' }, usages: ['verify', 'sign', 'verify', 'sign'], diff --git a/test/parallel/test-webcrypto-derivebits-cfrg.js b/test/parallel/test-webcrypto-derivebits-cfrg.js index fae39ac89c5e..134360c62751 100644 --- a/test/parallel/test-webcrypto-derivebits-cfrg.js +++ b/test/parallel/test-webcrypto-derivebits-cfrg.js @@ -6,7 +6,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const { subtle } = globalThis.crypto; const rejectsXCurves = hasFIPS(3, 5); @@ -22,7 +22,7 @@ const kTests = [ }, ]; -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { kTests.push( { name: 'X448', diff --git a/test/parallel/test-webcrypto-derivebits-hkdf.js b/test/parallel/test-webcrypto-derivebits-hkdf.js index 539440ea7c31..fafd6a7afa58 100644 --- a/test/parallel/test-webcrypto-derivebits-hkdf.js +++ b/test/parallel/test-webcrypto-derivebits-hkdf.js @@ -6,7 +6,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const { subtle } = globalThis.crypto; function getDeriveKeyInfo(name, length, hash, ...usages) { @@ -28,7 +28,7 @@ const kDerivedKeyTypes = [ ['AES-KW', 256, undefined, 'wrapKey', 'unwrapKey'], ]; -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { kDerivedKeyTypes.push( ['HMAC', 256, 'SHA3-256', 'sign', 'verify'], ['HMAC', 256, 'SHA3-384', 'sign', 'verify'], @@ -91,7 +91,7 @@ const kDerivations = { empty: '9e4b719033742101e90f1ad61e2ff3b4' + '256863667296d74389f1f02af2c4e6a6' }, - ...(!process.features.openssl_is_boringssl ? { + ...(!isBoringSSL ? { 'SHA3-256': { normal: '386b0693d7a58c4ddf01b49bfbbd2fa87c6f911991543995170ba20ed28df599', empty: 'd029bc828b6c6c8bb16ce3d25f5058f19c7d2517745e11c5d65c6d242e82e47f', @@ -131,7 +131,7 @@ const kDerivations = { empty: 'c8e12774135305c9147f2cc4766e5ead' + '25d8f457b9a1953d52677361ced558fb' }, - ...(!process.features.openssl_is_boringssl ? { + ...(!isBoringSSL ? { 'SHA3-256': { normal: '9befc557f5baf4075b5fb38c014b41b92ab7534150baf64201069e8807d0e83d', empty: '54d1fa1aa7cad99dab0622b772170e775c103756183bac36a228fd817a98a3f6', @@ -173,7 +173,7 @@ const kDerivations = { empty: 'e579d1f9e7f08e6f990ffcfcce1ed201' + 'c5e37e62cdf606f0ba4aca80427fbc44' }, - ...(!process.features.openssl_is_boringssl ? { + ...(!isBoringSSL ? { 'SHA3-256': { normal: '24f38fd1905554b7cbf8395cc3976292d11ce24a0b3131da0fd4b109832d27e3', empty: '33d0a5151c0f52e4bb7fb67cf7a17063127624dc3e685903f49ebb07872084d1', @@ -213,7 +213,7 @@ const kDerivations = { empty: 'b4f7e7557674d501cbfbc0148ad800c0' + '750189fe295a2aca5e1bf4122c85edf9' }, - ...(!process.features.openssl_is_boringssl ? { + ...(!isBoringSSL ? { 'SHA3-256': { normal: 'fe32459f7339dd2e8df6c6fc874ed9e81e3b7aad669edad9b71196f53ed95b12', empty: '04519be1eb94079c91306cc5b21946b3de6a78ad35ec83d4f4a37bafbda678d7', diff --git a/test/parallel/test-webcrypto-derivebits.js b/test/parallel/test-webcrypto-derivebits.js index 6ef2227ab2d2..184f997377d0 100644 --- a/test/parallel/test-webcrypto-derivebits.js +++ b/test/parallel/test-webcrypto-derivebits.js @@ -7,7 +7,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const { subtle } = globalThis.crypto; const requiresLongHkdfInputs = hasFIPS(3) && !hasFIPS(3, 5); const rejectsWeakPbkdf2Inputs = hasFIPS(4); @@ -152,7 +152,7 @@ const rejectsXCurves = hasFIPS(3, 5); } } else { test('X25519').then(common.mustCall()); - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { test('X448').then(common.mustCall()); } else { common.printSkipMessage('Skipping unsupported X448 test case'); diff --git a/test/parallel/test-webcrypto-derivekey-cfrg.js b/test/parallel/test-webcrypto-derivekey-cfrg.js index 13c4e56ce5b0..c9a9b60d091b 100644 --- a/test/parallel/test-webcrypto-derivekey-cfrg.js +++ b/test/parallel/test-webcrypto-derivekey-cfrg.js @@ -6,7 +6,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const { subtle } = globalThis.crypto; const rejectsXCurves = hasFIPS(3, 5); @@ -22,7 +22,7 @@ const kTests = [ }, ]; -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { kTests.push( { name: 'X448', diff --git a/test/parallel/test-webcrypto-derivekey.js b/test/parallel/test-webcrypto-derivekey.js index 631951c3f767..516838aaf0bf 100644 --- a/test/parallel/test-webcrypto-derivekey.js +++ b/test/parallel/test-webcrypto-derivekey.js @@ -6,7 +6,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { subtle } = globalThis.crypto; @@ -87,7 +87,7 @@ const fips4 = hasFIPS(4); 'a7abd704d0be364c6d4a530b6f93fcaff95474a2eee5a127ff86c5d095a2a812'], ]; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { kTests.push( ['hello hello hello', 'there', 'my friend indeed', 'SHA3-256', '89b3751df2ada85322a57ec82f7d0a5c233c6def91c92e681bc5118bd5768dca'], @@ -140,7 +140,7 @@ const fips4 = hasFIPS(4); '12790ce09027db067d680670f4dc704715b5120d139e8fde810afc34fb66f9f1'], ]; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { kTests.push( ['hello hello hello', 'my friend indeed', 1000, 'SHA3-256', '0f69b46660cba27b95215d5676492c64ed6abf6d426669a4a02b0ca3a1c36c11'], @@ -176,7 +176,7 @@ const fips4 = hasFIPS(4); [{ name: 'HMAC', hash: 'SHA-512' }, 'sign', 1024], ]; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { vectors.push( [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256], [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384], @@ -236,7 +236,7 @@ const fips4 = hasFIPS(4); [{ name: 'HMAC', hash: 'SHA-512' }, 'sign', 1024], ]; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { vectors.push( [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256], [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384], @@ -372,7 +372,7 @@ if (hasOpenSSL(3) && !hasFIPS()) { } } else { test('X25519').then(common.mustCall()); - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { test('X448').then(common.mustCall()); } else { common.printSkipMessage('Skipping unsupported X448 test case'); diff --git a/test/parallel/test-webcrypto-digest.js b/test/parallel/test-webcrypto-digest.js index 7c0ef7668c61..47a56a912d69 100644 --- a/test/parallel/test-webcrypto-digest.js +++ b/test/parallel/test-webcrypto-digest.js @@ -9,7 +9,7 @@ const assert = require('assert'); const { Buffer } = require('buffer'); const { subtle } = globalThis.crypto; const { createHash, getHashes } = require('crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const fips = hasFIPS(); const kTests = [ @@ -19,7 +19,7 @@ const kTests = [ ['SHA-512', ['sha512'], 512], ]; -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { kTests.push( [{ name: 'cSHAKE128', outputLength: 256 }, ['shake128', { outputLength: 256 >> 3 }], 256], [{ name: 'cSHAKE256', outputLength: 512 }, ['shake256', { outputLength: 512 >> 3 }], 512], @@ -150,7 +150,7 @@ const kDigestedData = { '60b22aab8d36a4c2a3affdb71234f49276737c575ddf7' + '4d14054cbd6fdb98fd0ddcbcb46f91ad76b6ee' }, - ...(!process.features.openssl_is_boringssl ? { + ...(!isBoringSSL ? { 'cshake128': { empty: '7f9c2ba4e88f827d616045507605853ed73b8093f6e' + 'fbc88eb1a6eacfa66ef26', diff --git a/test/parallel/test-webcrypto-encap-decap-ml-kem.js b/test/parallel/test-webcrypto-encap-decap-ml-kem.js index dbb0a7d3fa8b..0503e66da235 100644 --- a/test/parallel/test-webcrypto-encap-decap-ml-kem.js +++ b/test/parallel/test-webcrypto-encap-decap-ml-kem.js @@ -6,9 +6,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) +if (!hasOpenSSL(3, 5) && !isBoringSSL) common.skip('requires OpenSSL >= 3.5 or BoringSSL'); const assert = require('assert'); @@ -288,7 +288,7 @@ async function testDecapsulateBits({ name, publicKeyPem, privateKeyPem, results const variations = []; for (const vector of vectors) { - if (process.features.openssl_is_boringssl && vector.name === 'ML-KEM-512') { + if (isBoringSSL && vector.name === 'ML-KEM-512') { common.printSkipMessage(`Skipping unsupported ${vector.name} test`); continue; } diff --git a/test/parallel/test-webcrypto-encrypt-decrypt.js b/test/parallel/test-webcrypto-encrypt-decrypt.js index 1015752a8b0a..9a10b214d7aa 100644 --- a/test/parallel/test-webcrypto-encrypt-decrypt.js +++ b/test/parallel/test-webcrypto-encrypt-decrypt.js @@ -6,7 +6,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const { getFips } = require('crypto'); const { subtle } = globalThis.crypto; @@ -59,7 +59,7 @@ const { subtle } = globalThis.crypto; } // Test Encrypt/Decrypt RSA-OAEP w/ SHA-3 -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { const buf = globalThis.crypto.getRandomValues(new Uint8Array(50)); async function test() { diff --git a/test/parallel/test-webcrypto-export-import-cfrg.js b/test/parallel/test-webcrypto-export-import-cfrg.js index fb8014840f34..1cc1cd478ac8 100644 --- a/test/parallel/test-webcrypto-export-import-cfrg.js +++ b/test/parallel/test-webcrypto-export-import-cfrg.js @@ -8,7 +8,7 @@ if (!common.hasCrypto) const assert = require('assert'); const crypto = require('crypto'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const { subtle } = globalThis.crypto; const rejectsXCurves = hasFIPS(3, 5); @@ -96,7 +96,7 @@ const testVectors = [ }, ]; -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { testVectors.push( { name: 'Ed448', diff --git a/test/parallel/test-webcrypto-export-import-ml-dsa.js b/test/parallel/test-webcrypto-export-import-ml-dsa.js index 9c6e04da053c..d79b8138f8ac 100644 --- a/test/parallel/test-webcrypto-export-import-ml-dsa.js +++ b/test/parallel/test-webcrypto-export-import-ml-dsa.js @@ -5,9 +5,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) +if (!hasOpenSSL(3, 5) && !isBoringSSL) common.skip('requires OpenSSL >= 3.5 or BoringSSL'); const assert = require('assert'); @@ -105,7 +105,7 @@ async function testImportPkcs8({ name, privateUsages }, extractable) { extractable, privateUsages); } catch (err) { - if (process.features.openssl_is_boringssl) { + if (isBoringSSL) { assert.strictEqual(err.name, 'DataError'); assert.strictEqual(err.cause.code, 'ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED'); common.printSkipMessage('Skipping unsupported private key format test'); @@ -525,7 +525,7 @@ async function testImportRawSeed({ name, privateUsages }, extractable) { } })().then(common.mustCall()); -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { (async function() { for (const { name, privateUsages } of testVectors) { const pem = fixtures.readKey(getKeyFileName(name.toLowerCase(), 'private_priv_only'), 'ascii'); diff --git a/test/parallel/test-webcrypto-export-import-ml-kem.js b/test/parallel/test-webcrypto-export-import-ml-kem.js index 862eea96726d..c6ae5e51c566 100644 --- a/test/parallel/test-webcrypto-export-import-ml-kem.js +++ b/test/parallel/test-webcrypto-export-import-ml-kem.js @@ -5,9 +5,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) +if (!hasOpenSSL(3, 5) && !isBoringSSL) common.skip('requires OpenSSL >= 3.5 or BoringSSL'); const assert = require('assert'); @@ -105,7 +105,7 @@ async function testImportPkcs8({ name, privateUsages }, extractable) { extractable, privateUsages); } catch (err) { - if (process.features.openssl_is_boringssl) { + if (isBoringSSL) { assert.strictEqual(err.name, 'DataError'); assert.strictEqual(err.cause.code, 'ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED'); @@ -469,7 +469,7 @@ async function testImportJwk({ name, publicUsages, privateUsages }, extractable) (async function() { const tests = []; for (const vector of testVectors) { - if (process.features.openssl_is_boringssl && vector.name === 'ML-KEM-512') { + if (isBoringSSL && vector.name === 'ML-KEM-512') { common.printSkipMessage('Skipping unsupported ML-KEM-512 test'); continue; } @@ -525,7 +525,7 @@ async function testImportJwk({ name, publicUsages, privateUsages }, extractable) } })().then(common.mustCall()); -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { (async function() { for (const { name, privateUsages } of testVectors) { const pem = fixtures.readKey(getKeyFileName(name.toLowerCase(), 'private_priv_only'), 'ascii'); diff --git a/test/parallel/test-webcrypto-export-import-rsa.js b/test/parallel/test-webcrypto-export-import-rsa.js index 294baff544a6..385b8e0bc520 100644 --- a/test/parallel/test-webcrypto-export-import-rsa.js +++ b/test/parallel/test-webcrypto-export-import-rsa.js @@ -1,6 +1,8 @@ 'use strict'; const common = require('../common'); + +const { isBoringSSL } = require('../common/crypto'); const fixtures = require('../common/fixtures'); if (!common.hasCrypto) @@ -19,7 +21,7 @@ const hashes = [ 'SHA-512', ]; -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { hashes.push( 'SHA3-256', 'SHA3-384', diff --git a/test/parallel/test-webcrypto-export-import.js b/test/parallel/test-webcrypto-export-import.js index 30d1ea622fae..385ae8c65e9d 100644 --- a/test/parallel/test-webcrypto-export-import.js +++ b/test/parallel/test-webcrypto-export-import.js @@ -6,7 +6,7 @@ const fixtures = require('../common/fixtures'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { subtle } = globalThis.crypto; @@ -518,7 +518,7 @@ if (hasOpenSSL(3)) { } // SHA-3 hashes and JWK "alg" -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { const rsa = fixtures.readKey('rsa_private_2048.pem'); const privateKey = createPrivateKey(rsa); const publicKey = createPublicKey(privateKey); diff --git a/test/parallel/test-webcrypto-keygen.js b/test/parallel/test-webcrypto-keygen.js index 6e264031c4d1..e63ea8dfc7da 100644 --- a/test/parallel/test-webcrypto-keygen.js +++ b/test/parallel/test-webcrypto-keygen.js @@ -6,7 +6,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { types: { isCryptoKey } } = require('util'); @@ -158,7 +158,7 @@ const vectors = { }, }; -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { vectors.Ed448 = { result: 'CryptoKeyPair', usages: [ @@ -200,7 +200,7 @@ if (hasOpenSSL(3)) { } } -if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { +if (hasOpenSSL(3, 5) || isBoringSSL) { for (const name of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) { vectors[name] = { result: 'CryptoKeyPair', @@ -504,7 +504,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { let fipsExponentTest; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { if (fips3) { fipsExponentTest = assert.rejects( subtle.generateKey({ @@ -722,7 +722,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { [1024, 'SHA-512', ['sign', 'verify']], ]; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { kTests.push( [256, 'SHA3-256', ['sign', 'verify']], [384, 'SHA3-384', ['sign', 'verify']], @@ -808,7 +808,7 @@ assert.throws(() => new CryptoKey(), { code: 'ERR_ILLEGAL_CONSTRUCTOR' }); ], ]; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { kTests.push( [ 'Ed448', @@ -836,7 +836,7 @@ assert.throws(() => new CryptoKey(), { code: 'ERR_ILLEGAL_CONSTRUCTOR' }); } // Test ML-DSA Key Generation -if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { +if (hasOpenSSL(3, 5) || isBoringSSL) { async function test( name, privateUsages, @@ -879,7 +879,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { } // Test ML-KEM Key Generation -if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { +if (hasOpenSSL(3, 5) || isBoringSSL) { async function test( name, privateUsages, @@ -916,7 +916,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { const kTests = ['ML-KEM-768', 'ML-KEM-1024']; - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { kTests.unshift('ML-KEM-512'); } else { common.printSkipMessage('Skipping unsupported ML-KEM-512 test'); diff --git a/test/parallel/test-webcrypto-sign-verify-eddsa.js b/test/parallel/test-webcrypto-sign-verify-eddsa.js index e34a3d43d2a3..2c1b0bd44001 100644 --- a/test/parallel/test-webcrypto-sign-verify-eddsa.js +++ b/test/parallel/test-webcrypto-sign-verify-eddsa.js @@ -5,7 +5,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const crypto = require('crypto'); @@ -31,7 +31,7 @@ const smallOrderVerifyVectors = [ }, ]; -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { smallOrderVerifyVectors.push({ name: 'Ed448', publicKey: Buffer.concat([Buffer.from([1]), Buffer.alloc(56)]), diff --git a/test/parallel/test-webcrypto-sign-verify-ml-dsa.js b/test/parallel/test-webcrypto-sign-verify-ml-dsa.js index ba6eab08efb1..6925c0782f81 100644 --- a/test/parallel/test-webcrypto-sign-verify-ml-dsa.js +++ b/test/parallel/test-webcrypto-sign-verify-ml-dsa.js @@ -5,9 +5,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); -if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) +if (!hasOpenSSL(3, 5) && !isBoringSSL) common.skip('requires OpenSSL >= 3.5 or BoringSSL'); const assert = require('assert'); diff --git a/test/parallel/test-webcrypto-sign-verify-rsa.js b/test/parallel/test-webcrypto-sign-verify-rsa.js index 12633cd50de2..5b5fc7a69e82 100644 --- a/test/parallel/test-webcrypto-sign-verify-rsa.js +++ b/test/parallel/test-webcrypto-sign-verify-rsa.js @@ -6,7 +6,7 @@ if (!common.hasCrypto) common.skip('missing crypto'); const assert = require('assert'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); const { subtle } = globalThis.crypto; const fips3 = hasFIPS(3); const rejectsSha1Signing = hasFIPS(3) && !hasFIPS(3, 5); @@ -269,7 +269,7 @@ async function testSaltLength(keyLength, hash, hLen) { ['SHA-256', 32], ['SHA-384', 48], ['SHA-512', 64], - ...(!process.features.openssl_is_boringssl ? [ + ...(!isBoringSSL ? [ ['SHA3-256', 32], ['SHA3-384', 48], ['SHA3-512', 64], diff --git a/test/parallel/test-webcrypto-sign-verify.js b/test/parallel/test-webcrypto-sign-verify.js index db6c9e093872..295f13782389 100644 --- a/test/parallel/test-webcrypto-sign-verify.js +++ b/test/parallel/test-webcrypto-sign-verify.js @@ -5,7 +5,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { getFips } = require('crypto'); @@ -152,7 +152,7 @@ if (hasOpenSSL(3)) { } // Test Sign/Verify Ed448 -if (!process.features.openssl_is_boringssl) { +if (!isBoringSSL) { async function test(data) { const ec = new TextEncoder(); const { publicKey, privateKey } = await subtle.generateKey({ @@ -174,7 +174,7 @@ if (!process.features.openssl_is_boringssl) { } // Test Sign/Verify ML-DSA -if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { +if (hasOpenSSL(3, 5) || isBoringSSL) { async function test(name, data) { const ec = new TextEncoder(); const { publicKey, privateKey } = await subtle.generateKey({ diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js index 5ffffe230ac6..60ceffd710c9 100644 --- a/test/parallel/test-webcrypto-wrap-unwrap.js +++ b/test/parallel/test-webcrypto-wrap-unwrap.js @@ -5,7 +5,7 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); -const { hasOpenSSL, hasFIPS } = require('../common/crypto'); +const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto'); const assert = require('assert'); const { getFips } = require('crypto'); @@ -206,7 +206,7 @@ async function generateKeysToWrap() { }, ]; - if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) { + if (hasOpenSSL(3, 5) || isBoringSSL) { for (const name of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) { parameters.push({ algorithm: { name }, @@ -217,7 +217,7 @@ async function generateKeysToWrap() { } } - if (!process.features.openssl_is_boringssl) { + if (!isBoringSSL) { parameters.push( { algorithm: { diff --git a/test/parallel/test-x509-escaping.js b/test/parallel/test-x509-escaping.js index ab91e3345556..47901140cac0 100644 --- a/test/parallel/test-x509-escaping.js +++ b/test/parallel/test-x509-escaping.js @@ -10,7 +10,7 @@ const { X509Certificate } = require('crypto'); const tls = require('tls'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); // Test that all certificate chains provided by the reporter are rejected. { @@ -59,8 +59,8 @@ const { hasOpenSSL3 } = require('../common/crypto'); 'IP Address:8.8.8.8', 'IP Address:8.8.4.4', // For backward-compatibility, include invalid IP address lengths. - hasOpenSSL3 ? 'IP Address:' : 'IP Address:', - hasOpenSSL3 ? 'IP Address:' : 'IP Address:', + hasOpenSSL(3) ? 'IP Address:' : 'IP Address:', + hasOpenSSL(3) ? 'IP Address:' : 'IP Address:', // IPv6 addresses are represented as OpenSSL does. 'IP Address:A0B:C0D:E0F:0:0:0:7A7B:7C7D', // Regular email addresses don't require escaping. @@ -88,22 +88,22 @@ const { hasOpenSSL3 } = require('../common/crypto'); // This is an OID that will likely never be assigned to anything, thus // OpenSSL should not know it. 'Registered ID:1.3.9999.12.34', - hasOpenSSL3 ? + hasOpenSSL(3) ? 'othername:XmppAddr:abc123' : 'othername:', - hasOpenSSL3 ? + hasOpenSSL(3) ? 'othername:"XmppAddr:abc123\\u002c DNS:good.example.com"' : 'othername:', - hasOpenSSL3 ? + hasOpenSSL(3) ? 'othername:"XmppAddr:good.example.com\\u0000abc123"' : 'othername:', // This is unsupported because the OID is not recognized. 'othername:', - hasOpenSSL3 ? 'othername:SRVName:abc123' : 'othername:', + hasOpenSSL(3) ? 'othername:SRVName:abc123' : 'othername:', // This is unsupported because it is an SRVName with a UTF8String value, // which is not allowed for SRVName. 'othername:', - hasOpenSSL3 ? + hasOpenSSL(3) ? 'othername:"SRVName:abc\\u0000def"' : 'othername:', ]; @@ -173,7 +173,7 @@ const { hasOpenSSL3 } = require('../common/crypto'); ], }, }, - hasOpenSSL3 ? { + hasOpenSSL(3) ? { text: 'OCSP - othername:XmppAddr:good.example.com\n' + 'OCSP - othername:\n' + 'OCSP - othername:SRVName:abc123', @@ -196,7 +196,7 @@ const { hasOpenSSL3 } = require('../common/crypto'); ], }, }, - hasOpenSSL3 ? { + hasOpenSSL(3) ? { text: 'OCSP - othername:"XmppAddr:good.example.com\\u0000abc123"', legacy: { 'OCSP - othername': [ @@ -222,7 +222,7 @@ const { hasOpenSSL3 } = require('../common/crypto'); // Test the subjectAltName property of the X509Certificate API. const cert = new X509Certificate(pem); assert.strictEqual(cert.infoAccess, - `${expected.text}${hasOpenSSL3 ? '' : '\n'}`); + `${expected.text}${hasOpenSSL(3) ? '' : '\n'}`); // Test that the certificate obtained by checkServerIdentity has the correct // subjectaltname property. @@ -439,7 +439,7 @@ const { hasOpenSSL3 } = require('../common/crypto'); // The hostname is the CN, but not a SAN entry. const servername = 'good.example.com'; - const cnFallback = process.features.openssl_is_boringssl ? undefined : + const cnFallback = isBoringSSL ? undefined : servername; const certX509 = new X509Certificate(cert); assert.strictEqual(certX509.subject, `CN=${servername}`); @@ -485,7 +485,7 @@ const { hasOpenSSL3 } = require('../common/crypto'); assert.strictEqual(certX509.subjectAltName, 'IP Address:1.2.3.4'); // The newer X509Certificate API allows customizing this behavior: - const cnFallback = process.features.openssl_is_boringssl ? undefined : + const cnFallback = isBoringSSL ? undefined : servername; assert.strictEqual(certX509.checkHost(servername), cnFallback); assert.strictEqual(certX509.checkHost(servername, { subject: 'default' }), diff --git a/test/pummel/test-crypto-dh-hash.js b/test/pummel/test-crypto-dh-hash.js index 03b4a9c831ae..e428df491a34 100644 --- a/test/pummel/test-crypto-dh-hash.js +++ b/test/pummel/test-crypto-dh-hash.js @@ -30,9 +30,9 @@ if (common.isPi()) { common.skip('Too slow for Raspberry Pi devices'); } -const { hasOpenSSL3 } = require('../common/crypto'); +const { hasOpenSSL } = require('../common/crypto'); -if (!hasOpenSSL3) { +if (!hasOpenSSL(3)) { common.skip('Too slow when dynamically linked against OpenSSL 1.1.1'); } diff --git a/test/pummel/test-crypto-dh-keys.js b/test/pummel/test-crypto-dh-keys.js index 824628732a55..cbfec26d14a1 100644 --- a/test/pummel/test-crypto-dh-keys.js +++ b/test/pummel/test-crypto-dh-keys.js @@ -32,7 +32,7 @@ if (common.isPi()) { const assert = require('assert'); const crypto = require('crypto'); -const { hasFIPS } = require('../common/crypto'); +const { hasFIPS, isBoringSSL } = require('../common/crypto'); for (const name of ['modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'modp17']) { // modp1 is 768 bits, FIPS requires >= 1024. @@ -47,7 +47,7 @@ for (const name of ['modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'mo continue; } if ((name === 'modp1' && crypto.getFips() === 1) || - (process.features.openssl_is_boringssl && + (isBoringSSL && (name === 'modp1' || name === 'modp2'))) { common.printSkipMessage(`Skipping unsupported ${name} test case`); continue; diff --git a/test/sequential/test-tls-psk-client.js b/test/sequential/test-tls-psk-client.js index 2eb6228f79f2..5cb429f47dec 100644 --- a/test/sequential/test-tls-psk-client.js +++ b/test/sequential/test-tls-psk-client.js @@ -5,7 +5,9 @@ if (!common.hasCrypto) { common.skip('missing crypto'); } -if (process.features.openssl_is_boringssl) { +const { isBoringSSL } = require('../common/crypto'); + +if (isBoringSSL) { require('../common/boringssl').testPskTls13Unsupported(); return; } diff --git a/test/wpt/status/WebCryptoAPI.cjs b/test/wpt/status/WebCryptoAPI.cjs index 095be39151ef..7715d5456152 100644 --- a/test/wpt/status/WebCryptoAPI.cjs +++ b/test/wpt/status/WebCryptoAPI.cjs @@ -3,6 +3,7 @@ const { hasOpenSSL, hasFIPS, + isBoringSSL, } = require('../../common/crypto.js'); const conditionalFileSkips = {}; @@ -10,7 +11,7 @@ const conditionalSubtestSkips = {}; function skip(...files) { for (const file of files) { - const provider = process.features.openssl_is_boringssl ? + const provider = isBoringSSL ? 'BoringSSL' : `OpenSSL ${process.versions.openssl}${hasFIPS(3) ? ' FIPS mode' : ''}`; conditionalFileSkips[file] = { @@ -49,7 +50,7 @@ if (!hasOpenSSL(3, 2) || hasFIPS(3)) { 'import_export/Argon2_importKey.tentative.https.any.js'); } -if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) { +if (!hasOpenSSL(3, 5) && !isBoringSSL) { skip( 'encap_decap/encap_decap_bits.tentative.https.any.js', 'encap_decap/encap_decap_keys.tentative.https.any.js', @@ -71,7 +72,7 @@ if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) { ]); } -if (process.features.openssl_is_boringssl) { +if (isBoringSSL) { skip( 'derive_bits_keys/cfrg_curves_bits_curve448.tentative.https.any.js', 'derive_bits_keys/cfrg_curves_keys_curve448.tentative.https.any.js',