Skip to content

Commit 0e87576

Browse files
panvaaduh95
panva
authored and
aduh95
committed
crypto: remove obsolete BoringSSL shims
BoringSSL implements OPENSSL_zalloc and BN_secure_new and provides compatible secure heap status stubs. Use the common code paths. Remove ClientHello helpers left unused by the early callback migration and require the fixed ML-KEM private-key import error. Signed-off-by: Filip Skokan <[email protected]> PR-URL: #65423 Backport-PR-URL: #65483 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Tim Perry <[email protected]>
1 parent 17d2b06 commit 0e87576

3 files changed

Lines changed: 2 additions & 84 deletions

File tree

‎deps/ncrypto/ncrypto.cc‎

Lines changed: 0 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -396,15 +396,7 @@ std::optional<std::string> CryptoErrorList::pop_front() {
396396

397397
// ============================================================================
398398
DataPointer DataPointer::Alloc(size_t len) {
399-
#ifdef OPENSSL_IS_BORINGSSL
400-
// Boringssl does not implement OPENSSL_zalloc
401-
auto ptr = OPENSSL_malloc(len);
402-
if (ptr == nullptr) return {};
403-
memset(ptr, 0, len);
404-
return DataPointer(ptr, len);
405-
#else
406399
return DataPointer(OPENSSL_zalloc(len), len);
407-
#endif
408400
}
409401

410402
DataPointer DataPointer::SecureAlloc(size_t len) {
@@ -427,18 +419,11 @@ DataPointer DataPointer::SecureAlloc(size_t len) {
427419
}
428420

429421
size_t DataPointer::GetSecureHeapUsed() {
430-
#ifndef OPENSSL_IS_BORINGSSL
431422
return CRYPTO_secure_malloc_initialized() ? CRYPTO_secure_used() : 0;
432-
#else
433-
// BoringSSL does not have the secure heap and therefore
434-
// will always return 0.
435-
return 0;
436-
#endif
437423
}
438424

439425
DataPointer::InitSecureHeapResult DataPointer::TryInitSecureHeap(size_t amount,
440426
size_t min) {
441-
#ifndef OPENSSL_IS_BORINGSSL
442427
switch (CRYPTO_secure_malloc_init(amount, min)) {
443428
case 0:
444429
return InitSecureHeapResult::FAILED;
@@ -449,10 +434,6 @@ DataPointer::InitSecureHeapResult DataPointer::TryInitSecureHeap(size_t amount,
449434
default:
450435
return InitSecureHeapResult::FAILED;
451436
}
452-
#else
453-
// BoringSSL does not actually support the secure heap
454-
return InitSecureHeapResult::FAILED;
455-
#endif
456437
}
457438

458439
DataPointer DataPointer::Copy(const Buffer<const void>& buffer) {
@@ -580,12 +561,7 @@ BignumPointer BignumPointer::New() {
580561
}
581562

582563
BignumPointer BignumPointer::NewSecure() {
583-
#ifdef OPENSSL_IS_BORINGSSL
584-
// Boringssl does not implement BN_secure_new.
585-
return New();
586-
#else
587564
return BignumPointer(BN_secure_new());
588-
#endif
589565
}
590566

591567
BignumPointer& BignumPointer::operator=(BignumPointer&& other) noexcept {
@@ -4288,59 +4264,6 @@ std::optional<uint32_t> SSLPointer::verifyPeerCertificate() const {
42884264
return std::nullopt;
42894265
}
42904266

4291-
const char* SSLPointer::getClientHelloAlpn() const {
4292-
if (ssl_ == nullptr) return {};
4293-
#ifndef OPENSSL_IS_BORINGSSL
4294-
const unsigned char* buf;
4295-
size_t len;
4296-
size_t rem;
4297-
4298-
if (!SSL_client_hello_get0_ext(
4299-
get(),
4300-
TLSEXT_TYPE_application_layer_protocol_negotiation,
4301-
&buf,
4302-
&rem) ||
4303-
rem < 2) {
4304-
return {};
4305-
}
4306-
4307-
len = (buf[0] << 8) | buf[1];
4308-
if (len + 2 != rem) return {};
4309-
return reinterpret_cast<const char*>(buf + 3);
4310-
#else
4311-
// Boringssl doesn't have a public API for this.
4312-
return {};
4313-
#endif
4314-
}
4315-
4316-
const char* SSLPointer::getClientHelloServerName() const {
4317-
if (ssl_ == nullptr) return {};
4318-
#ifndef OPENSSL_IS_BORINGSSL
4319-
const unsigned char* buf;
4320-
size_t len;
4321-
size_t rem;
4322-
4323-
if (!SSL_client_hello_get0_ext(get(), TLSEXT_TYPE_server_name, &buf, &rem) ||
4324-
rem <= 2) {
4325-
return {};
4326-
}
4327-
4328-
len = (*buf << 8) | *(buf + 1);
4329-
if (len + 2 != rem) return {};
4330-
rem = len;
4331-
4332-
if (rem == 0 || *(buf + 2) != TLSEXT_NAMETYPE_host_name) return {};
4333-
rem--;
4334-
if (rem <= 2) return {};
4335-
len = (*(buf + 3) << 8) | *(buf + 4);
4336-
if (len + 2 > rem) return {};
4337-
return reinterpret_cast<const char*>(buf + 5);
4338-
#else
4339-
// Boringssl doesn't have a public API for this.
4340-
return {};
4341-
#endif
4342-
}
4343-
43444267
std::optional<const std::string_view> SSLPointer::GetServerName(
43454268
const SSL* ssl) {
43464269
if (ssl == nullptr) return std::nullopt;

‎deps/ncrypto/ncrypto.h‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1346,9 +1346,6 @@ class SSLPointer final {
13461346
bool setSession(const SSLSessionPointer& session);
13471347
bool setSniContext(const SSLCtxPointer& ctx) const;
13481348

1349-
const char* getClientHelloAlpn() const;
1350-
const char* getClientHelloServerName() const;
1351-
13521349
std::optional<const std::string_view> getServerName() const;
13531350
X509View getCertificate() const;
13541351
EVPKeyPointer getPeerTempKey() const;

‎test/parallel/test-webcrypto-export-import-ml-kem.js‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -107,10 +107,8 @@ async function testImportPkcs8({ name, privateUsages }, extractable) {
107107
} catch (err) {
108108
if (process.features.openssl_is_boringssl) {
109109
assert.strictEqual(err.name, 'DataError');
110-
// It should really only be ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED
111-
// but BoringSSL is inconsistent between handling ML-KEM and ML-DSA
112-
// Fixed in https://github.com/google/boringssl/commit/94c4c7f9e0eeeff72ea1ac6abf1aed5bd2a82c0c
113-
assert.match(err.cause.code, /ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM|ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED/);
110+
assert.strictEqual(err.cause.code,
111+
'ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED');
114112
common.printSkipMessage('Skipping unsupported private key format test');
115113
return;
116114
}

0 commit comments

Comments
 (0)