Commit acbc3ff1333 for nodejs
commit acbc3ff133318aa2e19a57da6e8a4ae32aeec4e0
Author: Filip Skokan <panva.ip@gmail.com>
Date: Sun Jul 26 14:18:38 2026 +0200
test,benchmark: drop OpenSSL 1.x-only coverage
Delete test-crypto-ecb.js, which can no longer run anywhere: Blowfish
is available only from OpenSSL's legacy provider and is absent from
BoringSSL.
The addon and cctest version guards become OPENSSL_IS_BORINGSSL checks.
Remove legacy digest-alias coverage and unreachable OpenSSL 1.x
branches. JavaScript test and benchmark gates, skip reasons, and TLS
error expectations that distinguished OpenSSL 1.x from provider-backed
OpenSSL now distinguish BoringSSL, including PKCS12 parsing, named DH
groups, private-key serialization, RSA-PSS parameters, consolidated
provider caches, FIPS availability, and empty KMAC output. Keep the CCM
alternate finalization error only for BoringSSL.
Provider-only test skips use version-neutral terminology or state the
actual minimum OpenSSL version.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
diff --git a/benchmark/crypto/kem.js b/benchmark/crypto/kem.js
index 34374dfc849..05e640e1f5b 100644
--- a/benchmark/crypto/kem.js
+++ b/benchmark/crypto/kem.js
@@ -35,12 +35,12 @@ if (hasOpenSSL(3, 2)) {
keyFixtures.x25519 = readKeyPair('x25519_public', 'x25519_private');
keyFixtures.x448 = readKeyPair('x448_public', 'x448_private');
}
-if (hasOpenSSL(3, 0)) {
+if (!isBoringSSL) {
keyFixtures.rsa = readKeyPair('rsa_public_2048', 'rsa_private_2048');
}
if (Object.keys(keyFixtures).length === 0) {
- console.log('no supported key types available for this OpenSSL version');
+ console.log('no supported key types available for this crypto implementation');
process.exit(0);
}
diff --git a/benchmark/crypto/mac.js b/benchmark/crypto/mac.js
index ea9d3a56e59..a6ff89f22ea 100644
--- a/benchmark/crypto/mac.js
+++ b/benchmark/crypto/mac.js
@@ -1,7 +1,7 @@
'use strict';
const common = require('../common.js');
-const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
+const { isBoringSSL } = require('../../test/common/crypto.js');
const assert = require('node:assert');
const {
createHmac,
@@ -9,11 +9,10 @@ const {
getMacs,
} = require('node:crypto');
-if (!hasOpenSSL(3) ||
- isBoringSSL ||
+if (isBoringSSL ||
typeof createMac !== 'function' ||
typeof getMacs !== 'function') {
- console.log('Skipping: generic MAC API requires OpenSSL >= 3');
+ console.log('Skipping: generic MAC API requires OpenSSL EVP_MAC support');
process.exit(0);
}
diff --git a/test/addons/openssl-providers/binding.cc b/test/addons/openssl-providers/binding.cc
index 785a103bb6c..36f8de59ccd 100644
--- a/test/addons/openssl-providers/binding.cc
+++ b/test/addons/openssl-providers/binding.cc
@@ -1,8 +1,9 @@
#include <assert.h>
#include <node.h>
-#include <openssl/opensslv.h>
-#if OPENSSL_VERSION_MAJOR >= 3
+// BoringSSL declares OPENSSL_IS_BORINGSSL in crypto.h.
+#include <openssl/crypto.h>
+#ifndef OPENSSL_IS_BORINGSSL
#include <openssl/provider.h>
#endif
@@ -18,7 +19,7 @@ using v8::Object;
using v8::String;
using v8::Value;
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
int collectProviders(OSSL_PROVIDER* provider, void* cbdata) {
static_cast<std::vector<OSSL_PROVIDER*>*>(cbdata)->push_back(provider);
return 1;
@@ -28,7 +29,7 @@ int collectProviders(OSSL_PROVIDER* provider, void* cbdata) {
inline void GetProviders(const FunctionCallbackInfo<Value>& args) {
Isolate* isolate = args.GetIsolate();
LocalVector<Value> arr(isolate, 0);
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
std::vector<OSSL_PROVIDER*> providers;
OSSL_PROVIDER_do_all(nullptr, &collectProviders, &providers);
for (auto provider : providers) {
diff --git a/test/addons/openssl-providers/providers.cjs b/test/addons/openssl-providers/providers.cjs
index 7e7a958b900..08cab0d4687 100644
--- a/test/addons/openssl-providers/providers.cjs
+++ b/test/addons/openssl-providers/providers.cjs
@@ -4,10 +4,10 @@ const common = require('../../common');
if (!common.hasCrypto) {
common.skip('missing crypto');
}
-const { hasOpenSSL } = require('../../common/crypto');
+const { isBoringSSL } = require('../../common/crypto');
-if (!hasOpenSSL(3)) {
- common.skip('this test requires OpenSSL 3.x');
+if (isBoringSSL) {
+ common.skip('OpenSSL provider support is required');
}
const assert = require('node:assert');
const {
diff --git a/test/cctest/test_node_crypto_env.cc b/test/cctest/test_node_crypto_env.cc
index 1d31dc98329..4c349ac1a0a 100644
--- a/test/cctest/test_node_crypto_env.cc
+++ b/test/cctest/test_node_crypto_env.cc
@@ -26,7 +26,7 @@ TEST_F(NodeCryptoEnv, LoadBIO) {
// just put a random string into BIO
Local<String> key = String::NewFromUtf8(isolate_, "abcdef").ToLocalChecked();
ncrypto::BIOPointer bio(node::crypto::LoadBIO(*env, key));
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#ifndef OPENSSL_IS_BORINGSSL
const int ofs = 2;
ASSERT_EQ(BIO_seek(bio.get(), ofs), ofs);
ASSERT_EQ(BIO_tell(bio.get()), ofs);
diff --git a/test/common/crypto.js b/test/common/crypto.js
index 49678e0de43..80a22c89aa1 100644
--- a/test/common/crypto.js
+++ b/test/common/crypto.js
@@ -147,9 +147,6 @@ module.exports = {
hasOpenSSL,
hasFIPS,
isBoringSSL,
- get hasOpenSSL3() {
- return hasOpenSSL(3);
- },
// opensslCli defined lazily to reduce overhead of spawnSync
get opensslCli() {
if (opensslCli !== null) return opensslCli;
diff --git a/test/fixtures/webcrypto/supports-modern-algorithms.mjs b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
index 250646125fa..885725e99f0 100644
--- a/test/fixtures/webcrypto/supports-modern-algorithms.mjs
+++ b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
@@ -13,8 +13,8 @@ const shake128 = crypto.getHashes().includes('shake128');
const shake256 = crypto.getHashes().includes('shake256');
const cshake128 = crypto.getHashes().includes('cshake128');
const cshake256 = crypto.getHashes().includes('cshake256');
-const ocb = hasOpenSSL(3) && crypto.getCiphers().includes('aes-128-ocb');
-const kmac = hasOpenSSL(3) && crypto.getMacs().includes('kmac128');
+const ocb = !isBoringSSL && crypto.getCiphers().includes('aes-128-ocb');
+const kmac = !isBoringSSL && crypto.getMacs().includes('kmac128');
const hybridKems = !fips && pqc && (!boringSSL || shake256);
diff --git a/test/parallel/test-cli-node-options.js b/test/parallel/test-cli-node-options.js
index 375c46c11ab..fa290d23c96 100644
--- a/test/parallel/test-cli-node-options.js
+++ b/test/parallel/test-cli-node-options.js
@@ -12,7 +12,7 @@ const { Worker } = require('worker_threads');
const fixtures = require('../common/fixtures');
const tmpdir = require('../common/tmpdir');
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
tmpdir.refresh();
const printA = path.relative(tmpdir.path, fixtures.path('printA.js'));
@@ -65,7 +65,7 @@ if (common.isLinux) {
if (common.hasCrypto) {
expectNoWorker('--use-openssl-ca', 'B\n');
expectNoWorker('--use-bundled-ca', 'B\n');
- if (!hasOpenSSL(3))
+ if (isBoringSSL)
expectNoWorker('--openssl-config=_ossl_cfg', 'B\n');
if (common.isMacOS) {
expect('--use-system-ca', 'B\n');
diff --git a/test/parallel/test-config-json-schema.js b/test/parallel/test-config-json-schema.js
index 0d9cdb84555..05efa69e2b6 100644
--- a/test/parallel/test-config-json-schema.js
+++ b/test/parallel/test-config-json-schema.js
@@ -10,10 +10,10 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3)) {
- common.skip('this test requires OpenSSL 3.x');
+if (isBoringSSL) {
+ common.skip('this test is not supported with BoringSSL');
}
if (!common.hasIntl) {
diff --git a/test/parallel/test-crypto-async-sign-verify.js b/test/parallel/test-crypto-async-sign-verify.js
index a60dc73d67b..f4c754d118f 100644
--- a/test/parallel/test-crypto-async-sign-verify.js
+++ b/test/parallel/test-crypto-async-sign-verify.js
@@ -3,7 +3,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const util = require('util');
const crypto = require('crypto');
@@ -132,7 +132,7 @@ if (!isBoringSSL) {
common.printSkipMessage('Skipping unsupported ed448/secp256k1/dsa test cases');
}
-// Test Parallel Execution w/ KeyObject is threadsafe in openssl3
+// Test Parallel Execution w/ KeyObject is threadsafe in OpenSSL
{
const publicKey = {
key: crypto.createPublicKey(
@@ -171,12 +171,10 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
const data = crypto.randomBytes(32);
const signature = crypto.randomBytes(16);
- let expected = /no default digest/;
- let expectedCode = 'ERR_OSSL_EVP_NO_DEFAULT_DIGEST';
- if (hasOpenSSL(3) || isBoringSSL) {
- expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
- expectedCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
- }
+ const expected =
+ /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
+ const expectedCode =
+ 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
crypto.verify(undefined, data, untrustedKey, signature, common.mustCall((err) => {
assert.ok(err);
diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
index f321bb0105f..a6565aba077 100644
--- a/test/parallel/test-crypto-authenticated.js
+++ b/test/parallel/test-crypto-authenticated.js
@@ -819,7 +819,7 @@ for (const test of TEST_CASES) {
} catch (err) {
// OpenSSL without https://github.com/openssl/openssl/pull/32427
// cannot finalize an empty CCM message unless update() was called.
- if (hasOpenSSL(3)) {
+ if (!isBoringSSL) {
assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET');
} else {
assert.match(err.message, /Unsupported state/);
diff --git a/test/parallel/test-crypto-cipheriv-decipheriv.js b/test/parallel/test-crypto-cipheriv-decipheriv.js
index d2c216924ea..ab429ecb1d3 100644
--- a/test/parallel/test-crypto-cipheriv-decipheriv.js
+++ b/test/parallel/test-crypto-cipheriv-decipheriv.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const crypto = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
const isFipsEnabled = crypto.getFips() === 1;
const fips3 = hasFIPS(3);
@@ -293,8 +293,8 @@ assert.throws(
errMessage);
// But all other IV lengths should be accepted.
-const minIvLength = hasOpenSSL(3) ? 8 : 1;
-const maxIvLength = hasOpenSSL(3) ? 64 : 256;
+const minIvLength = isBoringSSL ? 1 : 8;
+const maxIvLength = isBoringSSL ? 256 : 64;
for (let n = minIvLength; n < maxIvLength; n += 1) {
if (isFipsEnabled && n < 12) continue;
crypto.createCipheriv('aes-128-gcm', Buffer.alloc(16), Buffer.alloc(n));
diff --git a/test/parallel/test-crypto-classes.js b/test/parallel/test-crypto-classes.js
index 48d68c93fb6..e875f706110 100644
--- a/test/parallel/test-crypto-classes.js
+++ b/test/parallel/test-crypto-classes.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
const crypto = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
// 'ClassName' : ['args', 'for', 'constructor']
const TEST_CASES = {
@@ -31,7 +31,7 @@ if (hasFIPS(3)) {
TEST_CASES.DiffieHellman = [2048];
TEST_CASES.DiffieHellmanGroup = ['modp14'];
} else if (crypto.getFips() !== 1) {
- TEST_CASES.DiffieHellman = [hasOpenSSL(3) ? 1024 : 256];
+ TEST_CASES.DiffieHellman = [isBoringSSL ? 256 : 1024];
}
for (const [clazz, args] of Object.entries(TEST_CASES)) {
diff --git a/test/parallel/test-crypto-dh-curves.js b/test/parallel/test-crypto-dh-curves.js
index ef5d0323d33..0b2270b37a3 100644
--- a/test/parallel/test-crypto-dh-curves.js
+++ b/test/parallel/test-crypto-dh-curves.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const crypto = require('crypto');
-const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
const {
DH_CHECK_P_NOT_PRIME,
DH_CHECK_P_NOT_SAFE_PRIME,
@@ -70,7 +70,7 @@ const bad_dh = isBoringSSL ?
crypto.createDiffieHellman('02', 'hex');
assert.notStrictEqual(bad_dh.verifyError, 0);
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
const smallSafePrime = crypto.createDiffieHellman(
Buffer.from([23]), Buffer.from([2]));
assert.notStrictEqual(smallSafePrime.verifyError, 0);
@@ -79,11 +79,6 @@ if (hasOpenSSL(3)) {
() => crypto.createDiffieHellman(Buffer.from(p, 'hex'),
Buffer.from(p, 'hex')),
{ code: 'ERR_OSSL_DH_BAD_GENERATOR' });
-} else if (!isBoringSSL) {
- assert.strictEqual(
- crypto.createDiffieHellman(Buffer.from(p, 'hex'),
- Buffer.from(p, 'hex')).verifyError,
- DH_NOT_SUITABLE_GENERATOR);
}
const availableCurves = new Set(crypto.getCurves());
@@ -279,7 +274,7 @@ if (availableCurves.has('prime256v1') && availableHashes.has('sha256')) {
crypto.createSign('SHA256').sign(ecPrivateKey);
}
-if (hasFIPS(3) && availableCurves.has('secp256k1')) {
+if (hasFIPS() && availableCurves.has('secp256k1')) {
const originalFips = crypto.getFips();
try {
diff --git a/test/parallel/test-crypto-dh-errors.js b/test/parallel/test-crypto-dh-errors.js
index d9f7065655c..d697a72a09f 100644
--- a/test/parallel/test-crypto-dh-errors.js
+++ b/test/parallel/test-crypto-dh-errors.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
// https://github.com/nodejs/node/issues/32738
// XXX(bnoordhuis) validateInt32() throwing ERR_OUT_OF_RANGE and RangeError
@@ -25,7 +25,7 @@ assert.throws(() => crypto.createDiffieHellman('abcdef', 13.37), {
});
for (const bits of [-1, 0, 1]) {
- if (hasOpenSSL(3)) {
+ if (!isBoringSSL) {
assert.throws(() => crypto.createDiffieHellman(bits), {
code: 'ERR_OSSL_DH_MODULUS_TOO_SMALL',
name: 'Error',
diff --git a/test/parallel/test-crypto-dh-odd-key.js b/test/parallel/test-crypto-dh-odd-key.js
index c96227770e3..32d83fe0d4f 100644
--- a/test/parallel/test-crypto-dh-odd-key.js
+++ b/test/parallel/test-crypto-dh-odd-key.js
@@ -27,12 +27,12 @@ if (!common.hasCrypto) {
const assert = require('assert');
const crypto = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
function test() {
const odd = Buffer.alloc(39, 'A');
- const size = hasFIPS(3) ? 2048 : (hasOpenSSL(3) ? 1024 : 32);
+ const size = hasFIPS(3) ? 2048 : (isBoringSSL ? 32 : 1024);
const c = crypto.createDiffieHellman(size);
c.setPrivateKey(odd);
c.generateKeys();
diff --git a/test/parallel/test-crypto-dh-stateless.js b/test/parallel/test-crypto-dh-stateless.js
index 9c0270304f2..d1e134aa4a1 100644
--- a/test/parallel/test-crypto-dh-stateless.js
+++ b/test/parallel/test-crypto-dh-stateless.js
@@ -20,7 +20,7 @@ let keyTypeMismatchCode;
if (hasOpenSSL(4, 0)) {
keyTypeMismatchCode =
/^ERR_OSSL_EVP_(OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE|INTERNAL_ERROR)$/;
-} else if (hasOpenSSL(3)) {
+} else if (!isBoringSSL) {
keyTypeMismatchCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
} else {
keyTypeMismatchCode = 'ERR_OSSL_EVP_DIFFERENT_KEY_TYPES';
@@ -341,15 +341,6 @@ if (isBoringSSL) {
// Same generator, but different primes.
[{ group: 'modp5' }, { group: 'modp18' }]];
- // TODO(danbev): Take a closer look if there should be a check in OpenSSL3
- // when the dh parameters differ.
- if (!hasOpenSSL(3)) {
- // Same primes, but different generator.
- list.push([{ group: 'modp5' }, { prime: group.getPrime(), generator: 5 }]);
- // Same generator, but different primes.
- list.push([{ primeLength: 1024 }, { primeLength: 1024 }]);
- }
-
for (const [params1, params2] of list) {
const options = {
privateKey: crypto.generateKeyPairSync('dh', params1).privateKey,
@@ -357,9 +348,7 @@ if (isBoringSSL) {
};
testDHError(options, {
name: 'Error',
- code: hasOpenSSL(3) ?
- 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' :
- 'ERR_OSSL_EVP_DIFFERENT_PARAMETERS'
+ code: 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS'
});
}
}
@@ -420,9 +409,9 @@ test(crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' }),
};
testDHError(options, {
name: 'Error',
- code: hasOpenSSL(3) ?
- 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' :
- 'ERR_OSSL_EVP_DIFFERENT_PARAMETERS'
+ code: isBoringSSL ?
+ 'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' :
+ 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS'
});
}
@@ -576,9 +565,9 @@ for (const { privateKey: alicePriv, publicKey: bobPub } of [
testDHError({
privateKey: privKey(ec256.privateKey),
publicKey: pubKey(ec384.publicKey),
- }, { code: hasOpenSSL(3) ?
- 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' :
- 'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' });
+ }, { code: isBoringSSL ?
+ 'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' :
+ 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' });
// Incompatible key types (ec + x25519)
testDHError({
@@ -607,8 +596,6 @@ for (const { privateKey: alicePriv, publicKey: bobPub } of [
privateKey: privKey(x25519.privateKey),
publicKey: pubKey(zeroX25519PublicKey),
}, isBoringSSL ? { code: 'ERR_OSSL_EVP_INVALID_PEER_KEY' } :
- hasOpenSSL(3) ?
- { code: 'ERR_OSSL_FAILED_DURING_DERIVATION' } :
- { message: /Deriving bits failed/ });
+ { code: 'ERR_OSSL_FAILED_DURING_DERIVATION' });
}
}
diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
index 7b9a9d50d89..5ef9450b86a 100644
--- a/test/parallel/test-crypto-dh.js
+++ b/test/parallel/test-crypto-dh.js
@@ -7,14 +7,13 @@ if (!common.hasCrypto) {
const assert = require('assert');
const crypto = require('crypto');
const {
- hasOpenSSL,
hasFIPS,
isBoringSSL,
} = require('../common/crypto');
{
const size = hasFIPS(3) ?
- 2048 : (crypto.getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
+ 2048 : (crypto.getFips() === 1 || !isBoringSSL ? 1024 : 256);
const dh1 = crypto.createDiffieHellman(size);
const p1 = dh1.getPrime('buffer');
const dh2 = crypto.createDiffieHellman(p1, 'buffer');
@@ -60,7 +59,7 @@ const {
assert.strictEqual(secret1, secret4);
let wrongBlockLength;
- if (hasOpenSSL(3)) {
+ if (!isBoringSSL) {
wrongBlockLength = {
message: /wrong[\s_]final[\s_]block[\s_]length/i,
code: /ERR_OSSL_(EVP_)?WRONG_FINAL_BLOCK_LENGTH/,
diff --git a/test/parallel/test-crypto-ecb.js b/test/parallel/test-crypto-ecb.js
deleted file mode 100644
index 65c373d35d2..00000000000
--- a/test/parallel/test-crypto-ecb.js
+++ /dev/null
@@ -1,63 +0,0 @@
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-'use strict';
-const common = require('../common');
-if (!common.hasCrypto) {
- common.skip('missing crypto');
-}
-
-const { hasOpenSSL } = require('../common/crypto');
-const crypto = require('crypto');
-
-if (crypto.getFips()) {
- common.skip('BF-ECB is not FIPS 140-2 compatible');
-}
-
-if (hasOpenSSL(3)) {
- common.skip('Blowfish is only available with the legacy provider in ' +
- 'OpenSSl 3.x');
-}
-
-if (!crypto.getCiphers().includes('BF-ECB')) {
- common.skip('BF-ECB cipher is not available');
-}
-
-const assert = require('assert');
-
-// Testing whether EVP_CipherInit_ex is functioning correctly.
-// Reference: bug#1997
-
-{
- const encrypt =
- crypto.createCipheriv('BF-ECB', 'SomeRandomBlahz0c5GZVnR', '');
- let hex = encrypt.update('Hello World!', 'ascii', 'hex');
- hex += encrypt.final('hex');
- assert.strictEqual(hex.toUpperCase(), '6D385F424AAB0CFBF0BB86E07FFB7D71');
-}
-
-{
- const decrypt =
- crypto.createDecipheriv('BF-ECB', 'SomeRandomBlahz0c5GZVnR', '');
- let msg = decrypt.update('6D385F424AAB0CFBF0BB86E07FFB7D71', 'hex', 'ascii');
- msg += decrypt.final('ascii');
- assert.strictEqual(msg, 'Hello World!');
-}
diff --git a/test/parallel/test-crypto-encap-decap.js b/test/parallel/test-crypto-encap-decap.js
index 199ad68fa36..50a44f91051 100644
--- a/test/parallel/test-crypto-encap-decap.js
+++ b/test/parallel/test-crypto-encap-decap.js
@@ -16,11 +16,6 @@ const { promisify } = require('util');
const isBoringSSL = commonIsBoringSSL;
const isFips = hasFIPS(3);
-if (!hasOpenSSL(3) && !isBoringSSL) {
- assert.throws(() => crypto.encapsulate(), { code: 'ERR_CRYPTO_KEM_NOT_SUPPORTED' });
- return;
-}
-
assert.throws(() => crypto.encapsulate(), { code: 'ERR_INVALID_ARG_TYPE',
message: /The "key" argument must be of type/ });
assert.throws(() => crypto.decapsulate(), { code: 'ERR_INVALID_ARG_TYPE',
@@ -28,7 +23,7 @@ assert.throws(() => crypto.decapsulate(), { code: 'ERR_INVALID_ARG_TYPE',
const keys = {
'rsa': {
- supported: hasOpenSSL(3), // RSASVE was added in 3.0
+ supported: !isBoringSSL, // BoringSSL does not support RSASVE
publicKey: fixtures.readKey('rsa_public_2048.pem', 'ascii'),
privateKey: fixtures.readKey('rsa_private_2048.pem', 'ascii'),
sharedSecretLength: 256,
diff --git a/test/parallel/test-crypto-fips-indicator-strict.js b/test/parallel/test-crypto-fips-indicator-strict.js
index 5e003d7015b..b1024fc5235 100644
--- a/test/parallel/test-crypto-fips-indicator-strict.js
+++ b/test/parallel/test-crypto-fips-indicator-strict.js
@@ -31,7 +31,7 @@ const mode = process.env.NODE_TEST_FIPS_FORCE_MODE;
if (!hasOpenSSL(3, 4)) {
common.skip('OpenSSL 3.4 or later is required');
} else if (!hasFIPS(3, 4)) {
- common.skip('an active OpenSSL 3.4+ FIPS provider is required');
+ common.skip('an active OpenSSL FIPS provider is required');
} else if (mode === 'provider') {
assertSerializedMode(mode);
assert.strictEqual(
diff --git a/test/parallel/test-crypto-getcipherinfo.js b/test/parallel/test-crypto-getcipherinfo.js
index 4c8e0c01c08..1eeefaaf366 100644
--- a/test/parallel/test-crypto-getcipherinfo.js
+++ b/test/parallel/test-crypto-getcipherinfo.js
@@ -10,7 +10,7 @@ const {
getCiphers,
getCipherInfo,
} = require('crypto');
-const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
const assert = require('assert');
@@ -18,7 +18,7 @@ const ciphers = getCiphers();
assert.strictEqual(getCipherInfo(-1), undefined);
assert.strictEqual(getCipherInfo('cipher that does not exist'), undefined);
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
assert.deepStrictEqual(
ciphers.filter((cipher) => cipher.includes('cbc-hmac')), []);
for (const cipher of [
diff --git a/test/parallel/test-crypto-hkdf.js b/test/parallel/test-crypto-hkdf.js
index 7051c2fae07..88be6098725 100644
--- a/test/parallel/test-crypto-hkdf.js
+++ b/test/parallel/test-crypto-hkdf.js
@@ -13,7 +13,7 @@ const {
hkdfSync,
getHashes
} = require('crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
{
assert.throws(() => hkdf(), {
@@ -142,9 +142,6 @@ const algorithms = [
['sha256', '', 'salt', '', 10],
['sha512', 'secret', 'salt', '', 15],
];
-if (!hasOpenSSL(3) && !isBoringSSL)
- algorithms.push(['whirlpool', 'secret', '', 'info', 20]);
-
algorithms.forEach(([ hash, secret, salt, info, length ]) => {
{
const syncResult = hkdfSync(hash, secret, salt, info, length);
@@ -233,7 +230,7 @@ algorithms.forEach(([ hash, secret, salt, info, length ]) => {
});
-if (!hasOpenSSL(3)) {
+if (isBoringSSL) {
const kKnownUnsupported = ['shake128', 'shake256'];
for (const hash of getHashes()) {
if (kKnownUnsupported.includes(hash)) continue;
diff --git a/test/parallel/test-crypto-hmac.js b/test/parallel/test-crypto-hmac.js
index 1e19b3e972d..116daa5f311 100644
--- a/test/parallel/test-crypto-hmac.js
+++ b/test/parallel/test-crypto-hmac.js
@@ -69,19 +69,6 @@ function testHmac(algo, key, data, expected) {
'19fd6e1ba73d9ed2224dd5094a71babe85d9a892');
}
-{
- // Historically, dss1 and DSS1 are SHA-1 aliases.
- const key = '0123456789abcdef';
- const expected =
- crypto.createHmac('sha1', key).update('data').digest('hex');
-
- for (const algo of ['dss1', 'DSS1']) {
- assert.strictEqual(
- crypto.createHmac(algo, key).update('data').digest('hex'),
- expected);
- }
-}
-
// Test HMAC (Wikipedia Test Cases)
const wikipedia = [
{
diff --git a/test/parallel/test-crypto-job-error-parity.js b/test/parallel/test-crypto-job-error-parity.js
index ee9bd27bba6..06cb3c93b14 100644
--- a/test/parallel/test-crypto-job-error-parity.js
+++ b/test/parallel/test-crypto-job-error-parity.js
@@ -8,7 +8,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const crypto = require('crypto');
const fixtures = require('../common/fixtures');
@@ -195,7 +195,7 @@ const data = Buffer.from('test data');
}
// === crypto.encapsulate / crypto.decapsulate ===
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
// KEM: Decapsulate with wrong private key type
{
const rsaPublicKey = crypto.createPublicKey(
diff --git a/test/parallel/test-crypto-kem-shared-key.js b/test/parallel/test-crypto-kem-shared-key.js
index da28d5b4134..bc0e8e57811 100644
--- a/test/parallel/test-crypto-kem-shared-key.js
+++ b/test/parallel/test-crypto-kem-shared-key.js
@@ -18,9 +18,6 @@ const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
const fixtures = require('../common/fixtures');
const { subtle } = globalThis.crypto;
-if (!hasOpenSSL(3) && !isBoringSSL)
- common.skip('requires OpenSSL >= 3 or BoringSSL');
-
const encapsulateAsync = promisify(encapsulate);
const decapsulateAsync = promisify(decapsulate);
@@ -103,7 +100,7 @@ async function testKeys(keys) {
async function runMain() {
const types = [];
- if (hasOpenSSL(3)) {
+ if (!isBoringSSL) {
types.push(['rsa', 'rsa', 256, 256]);
}
if (hasOpenSSL(3, 2) && !hasFIPS(3)) {
diff --git a/test/parallel/test-crypto-key-encoding-provider-cipher.js b/test/parallel/test-crypto-key-encoding-provider-cipher.js
index 3ded8ed0a62..3f2c3dafd97 100644
--- a/test/parallel/test-crypto-key-encoding-provider-cipher.js
+++ b/test/parallel/test-crypto-key-encoding-provider-cipher.js
@@ -4,8 +4,8 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
-if (isBoringSSL || !hasOpenSSL(3))
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
common.skip('OpenSSL providers are required');
const assert = require('assert');
diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js
index 97810af5d9c..759f2af4399 100644
--- a/test/parallel/test-crypto-key-objects.js
+++ b/test/parallel/test-crypto-key-objects.js
@@ -25,7 +25,6 @@ const {
} = require('crypto');
const {
- hasOpenSSL,
hasFIPS,
isBoringSSL,
} = require('../common/crypto');
@@ -350,20 +349,14 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
// This should not cause a crash: https://github.com/nodejs/node/issues/25247
assert.throws(() => {
createPrivateKey({ key: '' });
- }, hasOpenSSL(3) ? {
- message: 'error:1E08010C:DECODER routines::unsupported',
- } : isBoringSSL ? {
+ }, isBoringSSL ? {
message: 'error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE',
code: 'ERR_OSSL_PEM_NO_START_LINE',
reason: 'NO_START_LINE',
library: 'PEM routines',
function: 'OPENSSL_internal',
} : {
- message: 'error:0909006C:PEM routines:get_name:no start line',
- code: 'ERR_OSSL_PEM_NO_START_LINE',
- reason: 'no start line',
- library: 'PEM routines',
- function: 'get_name',
+ message: 'error:1E08010C:DECODER routines::unsupported',
});
// This should not abort either: https://github.com/nodejs/node/issues/29904
@@ -382,15 +375,12 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
type: 'pkcs1'
});
createPrivateKey({ key, format: 'der', type: 'pkcs1' });
- }, hasOpenSSL(3) ? {
- message: /error:1E08010C:DECODER routines::unsupported/,
- library: 'DECODER routines'
- } : isBoringSSL ? {
+ }, isBoringSSL ? {
library: 'public key routines',
message: 'error:06000066:public key routines:OPENSSL_internal:DECODE_ERROR'
} : {
- message: /asn1 encoding/,
- library: 'asn1 encoding routines'
+ message: /error:1E08010C:DECODER routines::unsupported/,
+ library: 'DECODER routines'
});
}
@@ -791,14 +781,14 @@ for (const info of [
{
// Reading an encrypted key without a passphrase should fail.
- assert.throws(() => createPrivateKey(privateDsa), hasOpenSSL(3) ? {
- name: 'Error',
- message: 'error:07880109:common libcrypto routines::interrupted or ' +
- 'cancelled',
- } : {
+ assert.throws(() => createPrivateKey(privateDsa), isBoringSSL ? {
name: 'TypeError',
code: 'ERR_MISSING_PASSPHRASE',
message: 'Passphrase required for encrypted key'
+ } : {
+ name: 'Error',
+ message: 'error:07880109:common libcrypto routines::interrupted or ' +
+ 'cancelled',
});
// Reading an encrypted key with a passphrase that exceeds OpenSSL's buffer
@@ -807,10 +797,10 @@ for (const info of [
key: privateDsa,
format: 'pem',
passphrase: Buffer.alloc(1025, 'a')
- }), hasOpenSSL(3) ? { name: 'Error' } : {
+ }), isBoringSSL ? {
code: 'ERR_OSSL_PEM_BAD_PASSWORD_READ',
name: 'Error'
- });
+ } : { name: 'Error' });
// The buffer has a size of 1024 bytes, so this passphrase should be permitted
// (but will fail decryption).
diff --git a/test/parallel/test-crypto-key-store-pkcs11.js b/test/parallel/test-crypto-key-store-pkcs11.js
index fe3158b0cd5..56855b0d63e 100644
--- a/test/parallel/test-crypto-key-store-pkcs11.js
+++ b/test/parallel/test-crypto-key-store-pkcs11.js
@@ -3,9 +3,9 @@
const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
-if (!hasOpenSSL(3, 0))
- common.skip('requires OpenSSL 3.x');
+const { isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
+ common.skip('OpenSSL provider support is required');
// The PKCS#11 token, the OpenSSL configuration that activates a provider for
// it, and the PIN that unlocks it are all provided by the environment. See
diff --git a/test/parallel/test-crypto-key-store.js b/test/parallel/test-crypto-key-store.js
index d5636f350dc..8c8032cb5fb 100644
--- a/test/parallel/test-crypto-key-store.js
+++ b/test/parallel/test-crypto-key-store.js
@@ -2,9 +2,9 @@
const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasFIPS, hasOpenSSL } = require('../common/crypto');
-if (!hasOpenSSL(3))
- common.skip('requires OpenSSL 3.x');
+const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
+ common.skip('OpenSSL provider support is required');
// Verifies that crypto.createPrivateKey() can pass a WHATWG URL (here a file:
// URI) to an OpenSSL STORE loader, and that the resulting KeyObject works for
diff --git a/test/parallel/test-crypto-keygen-async-dsa-key-object.js b/test/parallel/test-crypto-keygen-async-dsa-key-object.js
index 52c82ea5725..9527383692a 100644
--- a/test/parallel/test-crypto-keygen-async-dsa-key-object.js
+++ b/test/parallel/test-crypto-keygen-async-dsa-key-object.js
@@ -4,7 +4,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
if (isBoringSSL)
common.skip('not supported by BoringSSL');
@@ -17,20 +17,20 @@ const {
// Test async DSA key object generation.
{
generateKeyPair('dsa', {
- modulusLength: hasOpenSSL(3) ? 2048 : 512,
+ modulusLength: 2048,
divisorLength: 256
}, common.mustSucceed((publicKey, privateKey) => {
assert.strictEqual(publicKey.type, 'public');
assert.strictEqual(publicKey.asymmetricKeyType, 'dsa');
assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
- modulusLength: hasOpenSSL(3) ? 2048 : 512,
+ modulusLength: 2048,
divisorLength: 256
});
assert.strictEqual(privateKey.type, 'private');
assert.strictEqual(privateKey.asymmetricKeyType, 'dsa');
assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
- modulusLength: hasOpenSSL(3) ? 2048 : 512,
+ modulusLength: 2048,
divisorLength: 256
});
}));
diff --git a/test/parallel/test-crypto-keygen-async-dsa.js b/test/parallel/test-crypto-keygen-async-dsa.js
index 5d0254491cd..884b4eca7db 100644
--- a/test/parallel/test-crypto-keygen-async-dsa.js
+++ b/test/parallel/test-crypto-keygen-async-dsa.js
@@ -9,7 +9,6 @@ const {
assertApproximateSize,
testSignVerify,
spkiExp,
- hasOpenSSL,
} = require('../common/crypto');
if (isBoringSSL)
@@ -19,7 +18,6 @@ const assert = require('assert');
const {
generateKeyPair,
} = require('crypto');
-
// Test async DSA key generation.
{
const privateKeyEncoding = {
@@ -28,7 +26,7 @@ const {
};
generateKeyPair('dsa', {
- modulusLength: hasOpenSSL(3) ? 2048 : 512,
+ modulusLength: 2048,
divisorLength: 256,
publicKeyEncoding: {
type: 'spki',
@@ -45,8 +43,8 @@ const {
// The private key is DER-encoded.
assert(Buffer.isBuffer(privateKeyDER));
- assertApproximateSize(publicKey, hasOpenSSL(3) ? 1194 : 440);
- assertApproximateSize(privateKeyDER, hasOpenSSL(3) ? 721 : 336);
+ assertApproximateSize(publicKey, 1194);
+ assertApproximateSize(privateKeyDER, 721);
// Since the private key is encrypted, signing shouldn't work anymore.
assert.throws(() => {
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
index cd7e59be97f..b876596df61 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
@@ -9,7 +9,6 @@ const {
testSignVerify,
spkiExp,
pkcs8EncExp,
- hasOpenSSL,
} = require('../common/crypto');
if (isBoringSSL)
@@ -19,7 +18,6 @@ const assert = require('assert');
const {
generateKeyPair,
} = require('crypto');
-
// Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
// private key with paramEncoding explicit.
{
@@ -44,13 +42,9 @@ const {
// Since the private key is encrypted, signing shouldn't work anymore.
assert.throws(() => testSignVerify(publicKey, privateKey),
- hasOpenSSL(3) ? {
+ {
message: 'error:07880109:common libcrypto ' +
'routines::interrupted or cancelled'
- } : {
- name: 'TypeError',
- code: 'ERR_MISSING_PASSPHRASE',
- message: 'Passphrase required for encrypted key'
});
testSignVerify(publicKey, {
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
index 5c0878fc634..f79b92eeae2 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
@@ -10,7 +10,6 @@ const {
testSignVerify,
spkiExp,
sec1EncExp,
- hasOpenSSL,
} = require('../common/crypto');
if (isBoringSSL)
@@ -50,13 +49,9 @@ const {
// Since the private key is encrypted, signing shouldn't work anymore.
assert.throws(() => testSignVerify(publicKey, privateKey),
- hasOpenSSL(3) ? {
+ {
message: 'error:07880109:common libcrypto ' +
'routines::interrupted or cancelled'
- } : {
- name: 'TypeError',
- code: 'ERR_MISSING_PASSPHRASE',
- message: 'Passphrase required for encrypted key'
});
testSignVerify(publicKey, { key: privateKey, passphrase: 'secret' });
diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
index ba86fcdb94e..545190bbc48 100644
--- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
+++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
@@ -12,7 +12,7 @@ const {
testSignVerify,
spkiExp,
pkcs8EncExp,
- hasOpenSSL,
+ isBoringSSL,
} = require('../common/crypto');
// Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
@@ -39,13 +39,13 @@ const {
// Since the private key is encrypted, signing shouldn't work anymore.
assert.throws(() => testSignVerify(publicKey, privateKey),
- hasOpenSSL(3) ? {
- message: 'error:07880109:common libcrypto ' +
- 'routines::interrupted or cancelled'
- } : {
+ isBoringSSL ? {
name: 'TypeError',
code: 'ERR_MISSING_PASSPHRASE',
message: 'Passphrase required for encrypted key'
+ } : {
+ message: 'error:07880109:common libcrypto ' +
+ 'routines::interrupted or cancelled'
});
testSignVerify(publicKey, {
diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
index 84ea9d2f7a9..82f8705a280 100644
--- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
+++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
@@ -13,7 +13,7 @@ const {
testSignVerify,
spkiExp,
sec1EncExp,
- hasOpenSSL,
+ isBoringSSL,
} = require('../common/crypto');
{
@@ -45,13 +45,13 @@ const {
// Since the private key is encrypted, signing shouldn't work anymore.
assert.throws(() => testSignVerify(publicKey, privateKey),
- hasOpenSSL(3) ? {
- message: 'error:07880109:common libcrypto ' +
- 'routines::interrupted or cancelled'
- } : {
+ isBoringSSL ? {
name: 'TypeError',
code: 'ERR_MISSING_PASSPHRASE',
message: 'Passphrase required for encrypted key'
+ } : {
+ message: 'error:07880109:common libcrypto ' +
+ 'routines::interrupted or cancelled'
});
testSignVerify(publicKey, { key: privateKey, passphrase: 'secret' });
diff --git a/test/parallel/test-crypto-keygen-async-rsa.js b/test/parallel/test-crypto-keygen-async-rsa.js
index 7a372ded9fc..19f83bc3882 100644
--- a/test/parallel/test-crypto-keygen-async-rsa.js
+++ b/test/parallel/test-crypto-keygen-async-rsa.js
@@ -14,7 +14,7 @@ const {
testEncryptDecrypt,
testSignVerify,
pkcs1EncExp,
- hasOpenSSL,
+ isBoringSSL,
} = require('../common/crypto');
// Test async RSA key generation with an encrypted private key.
@@ -51,14 +51,14 @@ const {
type: 'pkcs1',
format: 'der',
};
- const expectedError = hasOpenSSL(3) ? {
- name: 'Error',
- message: 'error:07880109:common libcrypto routines::interrupted or ' +
- 'cancelled'
- } : {
+ const expectedError = isBoringSSL ? {
name: 'TypeError',
code: 'ERR_MISSING_PASSPHRASE',
message: 'Passphrase required for encrypted key'
+ } : {
+ name: 'Error',
+ message: 'error:07880109:common libcrypto routines::interrupted or ' +
+ 'cancelled'
};
assert.throws(() => testSignVerify(publicKey, privateKey), expectedError);
diff --git a/test/parallel/test-crypto-keygen-bit-length.js b/test/parallel/test-crypto-keygen-bit-length.js
index 90d32cd73bc..2c37ef18798 100644
--- a/test/parallel/test-crypto-keygen-bit-length.js
+++ b/test/parallel/test-crypto-keygen-bit-length.js
@@ -6,7 +6,6 @@ if (!common.hasCrypto)
const {
isBoringSSL,
- hasOpenSSL,
hasFIPS,
} = require('../common/crypto');
@@ -18,7 +17,6 @@ const assert = require('assert');
const {
generateKeyPair,
} = require('crypto');
-
const fips3 = hasFIPS(3);
// This tests check that generateKeyPair returns correct bit length in
@@ -49,18 +47,16 @@ const fips3 = hasFIPS(3);
assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 513);
}));
- if (hasOpenSSL(3)) {
- generateKeyPair('dsa', {
- modulusLength: 2049,
- divisorLength: 256,
- }, common.mustCall((err, publicKey, privateKey) => {
- if (fips3) {
- assert.strictEqual(err?.code, 'ERR_OSSL_DSA_BAD_FFC_PARAMETERS');
- return;
- }
- assert.ifError(err);
- assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 2049);
- assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 2049);
- }));
- }
+ generateKeyPair('dsa', {
+ modulusLength: 2049,
+ divisorLength: 256,
+ }, common.mustCall((err, publicKey, privateKey) => {
+ if (fips3) {
+ assert.strictEqual(err?.code, 'ERR_OSSL_DSA_BAD_FFC_PARAMETERS');
+ return;
+ }
+ assert.ifError(err);
+ assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 2049);
+ assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 2049);
+ }));
}
diff --git a/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js b/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
index ccf98bcd376..9f2fc9b55c8 100644
--- a/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
+++ b/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
@@ -12,7 +12,7 @@ const {
const {
hasFIPS,
testSignVerify,
- hasOpenSSL,
+ isBoringSSL,
} = require('../common/crypto');
const fips4 = hasFIPS(4);
@@ -56,14 +56,14 @@ for (const type of ['pkcs1', 'pkcs8']) {
// the key, and not specifying a passphrase should fail when decoding it.
assert.throws(() => {
return testSignVerify(publicKey, privateKey);
- }, hasOpenSSL(3) ? {
- name: 'Error',
- code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED',
- message: 'error:07880109:common libcrypto routines::interrupted or cancelled'
- } : {
+ }, isBoringSSL ? {
name: 'TypeError',
code: 'ERR_MISSING_PASSPHRASE',
message: 'Passphrase required for encrypted key'
+ } : {
+ name: 'Error',
+ code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED',
+ message: 'error:07880109:common libcrypto routines::interrupted or cancelled'
});
}));
}
diff --git a/test/parallel/test-crypto-keygen-missing-oid.js b/test/parallel/test-crypto-keygen-missing-oid.js
index afe95dbee40..6fd81184480 100644
--- a/test/parallel/test-crypto-keygen-missing-oid.js
+++ b/test/parallel/test-crypto-keygen-missing-oid.js
@@ -11,36 +11,34 @@ const {
getCurves,
} = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
// This test creates EC key pairs on curves without associated OIDs.
// Specifying a key encoding should not crash.
{
- if (process.versions.openssl >= '1.1.1i') {
- for (const namedCurve of ['Oakley-EC2N-3', 'Oakley-EC2N-4']) {
- if (!getCurves().includes(namedCurve))
- continue;
+ for (const namedCurve of ['Oakley-EC2N-3', 'Oakley-EC2N-4']) {
+ if (!getCurves().includes(namedCurve))
+ continue;
- const expectedErrorCode =
- hasFIPS(3) ? 'ERR_OSSL_EC_UNKNOWN_GROUP' :
- hasOpenSSL(3) ? 'ERR_OSSL_MISSING_OID' : 'ERR_OSSL_EC_MISSING_OID';
- const params = {
- namedCurve,
- publicKeyEncoding: {
- format: 'der',
- type: 'spki'
- }
- };
+ const expectedErrorCode =
+ hasFIPS(3) ? 'ERR_OSSL_EC_UNKNOWN_GROUP' :
+ isBoringSSL ? 'ERR_OSSL_EC_MISSING_OID' : 'ERR_OSSL_MISSING_OID';
+ const params = {
+ namedCurve,
+ publicKeyEncoding: {
+ format: 'der',
+ type: 'spki'
+ }
+ };
- assert.throws(() => {
- generateKeyPairSync('ec', params);
- }, {
- code: expectedErrorCode
- });
+ assert.throws(() => {
+ generateKeyPairSync('ec', params);
+ }, {
+ code: expectedErrorCode
+ });
- generateKeyPair('ec', params, common.mustCall((err) => {
- assert.strictEqual(err.code, expectedErrorCode);
- }));
- }
+ generateKeyPair('ec', params, common.mustCall((err) => {
+ assert.strictEqual(err.code, expectedErrorCode);
+ }));
}
}
diff --git a/test/parallel/test-crypto-keygen.js b/test/parallel/test-crypto-keygen.js
index a68c7c07c93..37cb2629419 100644
--- a/test/parallel/test-crypto-keygen.js
+++ b/test/parallel/test-crypto-keygen.js
@@ -14,11 +14,7 @@ const {
} = require('crypto');
const { inspect } = require('util');
-const {
- hasOpenSSL,
- isBoringSSL: commonIsBoringSSL,
-} = require('../common/crypto');
-const isBoringSSL = commonIsBoringSSL;
+const { isBoringSSL } = require('../common/crypto');
// Test invalid parameter encoding.
{
@@ -379,12 +375,7 @@ const isBoringSSL = commonIsBoringSSL;
}
// Test invalid exponents. (caught by OpenSSL)
- let invalidExponentError = /bad e value/;
- if (isBoringSSL) {
- invalidExponentError = /BAD_E_VALUE/;
- } else if (hasOpenSSL(3)) {
- invalidExponentError = /exponent/;
- }
+ const invalidExponentError = isBoringSSL ? /BAD_E_VALUE/ : /exponent/;
for (const publicExponent of [1, 1 + 0x10001]) {
generateKeyPair('rsa', {
modulusLength: 4096,
diff --git a/test/parallel/test-crypto-mac-errors.js b/test/parallel/test-crypto-mac-errors.js
index 8bc8cebfcf5..7326ee88e95 100644
--- a/test/parallel/test-crypto-mac-errors.js
+++ b/test/parallel/test-crypto-mac-errors.js
@@ -6,10 +6,10 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3) || isBoringSSL) {
- common.skip('OpenSSL 3 EVP_MAC support is required');
+if (isBoringSSL) {
+ common.skip('OpenSSL EVP_MAC support is required');
}
const assert = require('node:assert');
diff --git a/test/parallel/test-crypto-mac-unsupported.js b/test/parallel/test-crypto-mac-unsupported.js
index 1721e9d1c1a..84fa4299667 100644
--- a/test/parallel/test-crypto-mac-unsupported.js
+++ b/test/parallel/test-crypto-mac-unsupported.js
@@ -6,9 +6,9 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
-if (hasOpenSSL(3) && !isBoringSSL) {
+if (!isBoringSSL) {
common.skip('this test requires a build without EVP_MAC support');
}
diff --git a/test/parallel/test-crypto-mac-vectors.js b/test/parallel/test-crypto-mac-vectors.js
index 19544ccf4ec..7e965f78618 100644
--- a/test/parallel/test-crypto-mac-vectors.js
+++ b/test/parallel/test-crypto-mac-vectors.js
@@ -8,10 +8,10 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3) || isBoringSSL) {
- common.skip('OpenSSL 3 EVP_MAC support is required');
+if (isBoringSSL) {
+ common.skip('OpenSSL EVP_MAC support is required');
}
const assert = require('node:assert');
diff --git a/test/parallel/test-crypto-mac.js b/test/parallel/test-crypto-mac.js
index deb2a8a3d32..267eea0e1ad 100644
--- a/test/parallel/test-crypto-mac.js
+++ b/test/parallel/test-crypto-mac.js
@@ -8,10 +8,10 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3) || isBoringSSL) {
- common.skip('OpenSSL 3 EVP_MAC support is required');
+if (isBoringSSL) {
+ common.skip('OpenSSL EVP_MAC support is required');
}
const assert = require('node:assert');
diff --git a/test/parallel/test-crypto-negative-zero.js b/test/parallel/test-crypto-negative-zero.js
index 0e9525fcaf6..8bf5d305a2f 100644
--- a/test/parallel/test-crypto-negative-zero.js
+++ b/test/parallel/test-crypto-negative-zero.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const crypto = require('crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
function getOutcome(fn) {
try {
@@ -88,9 +88,9 @@ function assertSameErrorOrSuccess(actual, expected) {
);
}
- if (!hasOpenSSL(3)) {
+ if (isBoringSSL) {
common.printSkipMessage(
- 'Skipping DSA divisorLength 0 key generation on OpenSSL 1.1.1');
+ 'BoringSSL does not support DSA key pair generation');
} else {
assertSameErrorOrSuccess(
getOutcome(() => crypto.generateKeyPairSync('dsa', {
diff --git a/test/parallel/test-crypto-no-algorithm.js b/test/parallel/test-crypto-no-algorithm.js
index 06aab7614ff..e0a37230b84 100644
--- a/test/parallel/test-crypto-no-algorithm.js
+++ b/test/parallel/test-crypto-no-algorithm.js
@@ -4,10 +4,10 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3))
- common.skip('this test requires OpenSSL 3.x');
+if (isBoringSSL)
+ common.skip('this test requires OpenSSL');
const assert = require('node:assert/strict');
const crypto = require('node:crypto');
diff --git a/test/parallel/test-crypto-padding.js b/test/parallel/test-crypto-padding.js
index dce34409400..7ad837c64b2 100644
--- a/test/parallel/test-crypto-padding.js
+++ b/test/parallel/test-crypto-padding.js
@@ -26,7 +26,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
// Input data.
const ODD_LENGTH_PLAIN = 'Hello node world!';
@@ -83,14 +83,14 @@ assert.strictEqual(enc(EVEN_LENGTH_PLAIN, true), EVEN_LENGTH_ENCRYPTED);
assert.throws(function() {
// Input must have block length %.
enc(ODD_LENGTH_PLAIN, false);
-}, hasOpenSSL(3) ? {
- message: /wrong[\s_]final[\s_]block[\s_]length/i,
- code: /ERR_OSSL(_EVP)?_WRONG_FINAL_BLOCK_LENGTH/,
- reason: /wrong[\s_]final[\s_]block[\s_]length/i,
-} : {
+}, isBoringSSL ? {
message: /data[\s_]not[\s_]multiple[\s_]of[\s_]block[\s_]length/i,
code: /ERR_OSSL(_EVP)?_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH/,
reason: /data[\s_]not[\s_]multiple[\s_]of[\s_]block[\s_]length/i,
+} : {
+ message: /wrong[\s_]final[\s_]block[\s_]length/i,
+ code: /ERR_OSSL(_EVP)?_WRONG_FINAL_BLOCK_LENGTH/,
+ reason: /wrong[\s_]final[\s_]block[\s_]length/i,
}
);
diff --git a/test/parallel/test-crypto-pbkdf2.js b/test/parallel/test-crypto-pbkdf2.js
index 5083396f733..3fe2645e2db 100644
--- a/test/parallel/test-crypto-pbkdf2.js
+++ b/test/parallel/test-crypto-pbkdf2.js
@@ -6,8 +6,8 @@ if (!common.hasCrypto)
const assert = require('assert');
const crypto = require('crypto');
const {
- hasOpenSSL,
hasFIPS,
+ isBoringSSL,
} = require('../common/crypto');
const fips4 = hasFIPS(4);
@@ -335,7 +335,7 @@ assert.throws(
}
);
-if (!hasOpenSSL(3)) {
+if (isBoringSSL) {
const kNotPBKDF2Supported = ['shake128', 'shake256'];
crypto.getHashes()
.filter((hash) => !kNotPBKDF2Supported.includes(hash))
diff --git a/test/parallel/test-crypto-pkcs12.js b/test/parallel/test-crypto-pkcs12.js
index 0ec9a2f544d..1e65bf20a45 100644
--- a/test/parallel/test-crypto-pkcs12.js
+++ b/test/parallel/test-crypto-pkcs12.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto) common.skip('missing crypto');
const assert = require('assert');
const crypto = require('crypto');
const fixtures = require('../common/fixtures');
-const { hasOpenSSL3, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
const fips3 = hasFIPS(3);
@@ -140,7 +140,7 @@ if (!fips3) {
assert.ok(additionalCertificates[0] instanceof crypto.X509Certificate);
}
-if (hasOpenSSL3) {
+if (!isBoringSSL) {
// Legacy algorithms (RC2-40-CBC) throw a recognizable, actionable error
// rather than a bare OpenSSL string. Mirrors the behavior added for the
// TLS path in https://github.com/nodejs/node/pull/54485.
diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
index cd8f8c926f5..1fb0fa19f08 100644
--- a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
+++ b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
@@ -102,12 +102,12 @@ for (const [asymmetricKeyType, pubLen] of [
if (!hasOpenSSL(3, 5) && !isBoringSSL) {
assert.throws(() => createPublicKey(keys.public), {
- code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
+ code: 'ERR_OSSL_EVP_DECODE_ERROR',
});
for (const pem of [keys.private, keys.private_seed_only, keys.private_priv_only]) {
assert.throws(() => createPrivateKey(pem), {
- code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
+ code: 'ERR_OSSL_UNSUPPORTED',
});
}
} else {
diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js
index d08a479f421..7ae706af400 100644
--- a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js
+++ b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js
@@ -102,12 +102,12 @@ for (const [asymmetricKeyType, pubLen] of [
if (!hasOpenSSL(3, 5) && !isBoringSSL) {
assert.throws(() => createPublicKey(keys.public), {
- code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
+ code: 'ERR_OSSL_EVP_DECODE_ERROR',
});
for (const pem of [keys.private, keys.private_seed_only, keys.private_priv_only]) {
assert.throws(() => createPrivateKey(pem), {
- code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
+ code: 'ERR_OSSL_UNSUPPORTED',
});
}
} else if (isBoringSSL && asymmetricKeyType === 'ml-kem-512') {
diff --git a/test/parallel/test-crypto-pqc-key-objects-slh-dsa.js b/test/parallel/test-crypto-pqc-key-objects-slh-dsa.js
index eff309468c3..090aa65f9dc 100644
--- a/test/parallel/test-crypto-pqc-key-objects-slh-dsa.js
+++ b/test/parallel/test-crypto-pqc-key-objects-slh-dsa.js
@@ -4,7 +4,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const {
@@ -101,11 +101,11 @@ for (const asymmetricKeyType of [
if (!hasOpenSSL(3, 5)) {
assert.throws(() => createPublicKey(keys.public), {
- code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
+ code: isBoringSSL ? 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM' : 'ERR_OSSL_EVP_DECODE_ERROR',
});
assert.throws(() => createPrivateKey(keys.private), {
- code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
+ code: isBoringSSL ? 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM' : 'ERR_OSSL_UNSUPPORTED',
});
} else {
const publicKey = createPublicKey(keys.public);
diff --git a/test/parallel/test-crypto-prime.js b/test/parallel/test-crypto-prime.js
index 6f43e3a0bfb..0831aee23e4 100644
--- a/test/parallel/test-crypto-prime.js
+++ b/test/parallel/test-crypto-prime.js
@@ -5,6 +5,7 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('assert');
+const { isBoringSSL } = require('../common/crypto');
const {
generatePrime,
@@ -165,7 +166,7 @@ generatePrime(
// The behavior when specifying only add without rem should depend on the
// safe option.
- if (process.versions.openssl >= '1.1.1f') {
+ if (!isBoringSSL) {
generatePrime(128, {
bigint: true,
add: 5n
@@ -215,7 +216,7 @@ generatePrime(
code: 'ERR_OUT_OF_RANGE'
});
- if (process.versions.openssl >= '1.1.1f') {
+ if (!isBoringSSL) {
// This is possible and allowed (but makes little sense).
assert.strictEqual(generatePrimeSync(4, {
add: 15n,
diff --git a/test/parallel/test-crypto-private-decrypt-gh32240.js b/test/parallel/test-crypto-private-decrypt-gh32240.js
index a38fcba6775..1e6c2d7626f 100644
--- a/test/parallel/test-crypto-private-decrypt-gh32240.js
+++ b/test/parallel/test-crypto-private-decrypt-gh32240.js
@@ -15,8 +15,8 @@ const {
} = require('crypto');
const {
- hasOpenSSL,
hasFIPS,
+ isBoringSSL,
} = require('../common/crypto');
const fips3 = hasFIPS(3);
@@ -64,8 +64,8 @@ function decrypt(key) {
}
decrypt(pkey);
-assert.throws(() => decrypt(pkeyEncrypted), hasOpenSSL(3) ?
+assert.throws(() => decrypt(pkeyEncrypted), isBoringSSL ?
+ { code: 'ERR_MISSING_PASSPHRASE' } :
{ message: 'error:07880109:common libcrypto routines::interrupted or ' +
- 'cancelled' } :
- { code: 'ERR_MISSING_PASSPHRASE' });
+ 'cancelled' });
decrypt(pkey); // Should not throw.
diff --git a/test/parallel/test-crypto-provider-cache-snapshot.js b/test/parallel/test-crypto-provider-cache-snapshot.js
index 522dedfc436..c6a06887512 100644
--- a/test/parallel/test-crypto-provider-cache-snapshot.js
+++ b/test/parallel/test-crypto-provider-cache-snapshot.js
@@ -5,13 +5,13 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('node:assert');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
const fixtures = require('../common/fixtures');
const tmpdir = require('../common/tmpdir');
const { buildSnapshot, runWithSnapshot } = require('../common/snapshot');
-if (!hasOpenSSL(3) || isBoringSSL)
- common.skip('this test requires OpenSSL 3.x');
+if (isBoringSSL)
+ common.skip('OpenSSL provider support is required');
const entry = fixtures.path('snapshot', 'crypto-provider-cache.js');
const buildEnv = {
diff --git a/test/parallel/test-crypto-provider-cache.js b/test/parallel/test-crypto-provider-cache.js
index bbfee76b615..2d57b63e523 100644
--- a/test/parallel/test-crypto-provider-cache.js
+++ b/test/parallel/test-crypto-provider-cache.js
@@ -5,9 +5,9 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3) || isBoringSSL)
- common.skip('this test requires OpenSSL 3 provider support');
+const { isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
+ common.skip('this test requires OpenSSL provider support');
const assert = require('node:assert');
const crypto = require('node:crypto');
diff --git a/test/parallel/test-crypto-provider-hash-options.js b/test/parallel/test-crypto-provider-hash-options.js
index ecccc02f01e..997b179413a 100644
--- a/test/parallel/test-crypto-provider-hash-options.js
+++ b/test/parallel/test-crypto-provider-hash-options.js
@@ -11,7 +11,7 @@ if (!common.hasCrypto) {
if (Number(process.versions.openssl.split('.')[0]) < 4 ||
isBoringSSL) {
- common.skip('OpenSSL 4 provider support is required');
+ common.skip('OpenSSL 4.0 or later is required');
}
const assert = require('node:assert');
diff --git a/test/parallel/test-crypto-provider-hashes.js b/test/parallel/test-crypto-provider-hashes.js
index 5e688303910..8953e2afa51 100644
--- a/test/parallel/test-crypto-provider-hashes.js
+++ b/test/parallel/test-crypto-provider-hashes.js
@@ -26,10 +26,10 @@ const {
sign,
verify,
} = require('node:crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3) || isBoringSSL) {
- common.skip('OpenSSL 3 provider support is required');
+if (isBoringSSL) {
+ common.skip('OpenSSL provider support is required');
}
const { internalBinding } = require('internal/test/binding');
diff --git a/test/parallel/test-crypto-publicDecrypt-fails-first-time.js b/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
index 21cc5f3ebce..297a6c24a3d 100644
--- a/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
+++ b/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
@@ -7,10 +7,10 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3)) {
- common.skip('only openssl3'); // https://github.com/nodejs/node/pull/42793#issuecomment-1107491901
+if (isBoringSSL) {
+ common.skip('this test is not supported with BoringSSL'); // https://github.com/nodejs/node/pull/42793#issuecomment-1107491901
}
const assert = require('assert');
diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js
index 6e47d2a1865..e050796e856 100644
--- a/test/parallel/test-crypto-rsa-dsa.js
+++ b/test/parallel/test-crypto-rsa-dsa.js
@@ -16,9 +16,7 @@ const {
} = require('../common/crypto');
const fips3 = hasFIPS(3);
const fips35 = hasFIPS(3, 5);
-const fips30 = fips3 && !fips35;
const fips4 = hasFIPS(4);
-const fipsDigestErrorCode = 'ERR_OSSL_DIGEST_NOT_ALLOWED';
const wrongPassphrase = 'wrong-password';
// Test certificates
@@ -40,34 +38,25 @@ const dsaPkcs8KeyPem = fixtures.readKey('dsa_private_pkcs8.pem');
const ec = new TextEncoder();
-const openssl1DecryptError = {
- message: 'error:06065064:digital envelope routines:EVP_DecryptFinal_ex:' +
- 'bad decrypt',
- code: 'ERR_OSSL_EVP_BAD_DECRYPT',
- reason: 'bad decrypt',
- function: 'EVP_DecryptFinal_ex',
- library: 'digital envelope routines',
-};
-
const decryptError = fips4 ?
- { code: 'ERR_OSSL_BAD_DECRYPT' } : hasOpenSSL(3) ?
- { message: 'error:1C800064:Provider routines::bad decrypt' } :
- isBoringSSL ? {
- message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
- code: 'ERR_OSSL_BAD_DECRYPT',
- reason: 'BAD_DECRYPT',
- function: 'OPENSSL_internal',
- library: 'Cipher functions',
- } :
- openssl1DecryptError;
+ { code: 'ERR_OSSL_BAD_DECRYPT' } :
+ isBoringSSL ? {
+ message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
+ code: 'ERR_OSSL_BAD_DECRYPT',
+ reason: 'BAD_DECRYPT',
+ function: 'OPENSSL_internal',
+ library: 'Cipher functions',
+ } : {
+ message: 'error:1C800064:Provider routines::bad decrypt',
+ };
const decryptPrivateKeyError = fips4 ? {
code: 'ERR_OSSL_BAD_DECRYPT',
-} : hasOpenSSL(3) ? {
- message: 'error:1C800064:Provider routines::bad decrypt',
} : isBoringSSL ? {
message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
-} : openssl1DecryptError;
+} : {
+ message: 'error:1C800064:Provider routines::bad decrypt',
+};
function getBufferCopy(buf) {
return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
@@ -168,10 +157,8 @@ function getBufferCopy(buf) {
}, encryptedBuffer);
assert.strictEqual(decryptedBufferWithPassword.toString(), input);
- // Now with RSA_NO_PADDING. Plaintext needs to match key size.
- // OpenSSL 3.x has a rsa_check_padding that will cause an error if
- // RSA_NO_PADDING is used.
- if (!hasOpenSSL(3)) {
+ // BoringSSL does not apply OpenSSL's rsa_check_padding validation here.
+ if (isBoringSSL) {
{
const plaintext = 'x'.repeat(rsaKeySize / 8);
encryptedBuffer = crypto.privateEncrypt({
@@ -541,21 +528,6 @@ if (!isBoringSSL) {
assert.strictEqual(verify.verify(dsaPubPem, signature, 'hex'), true);
- // Test the legacy 'DSS1' name.
- const sign2 = crypto.createSign('DSS1');
- sign2.update(input);
- if (fips30) {
- assert.throws(() => sign2.sign(dsaKeyPem, 'hex'), {
- code: fipsDigestErrorCode,
- });
- } else {
- const signature2 = sign2.sign(dsaKeyPem, 'hex');
-
- const verify2 = crypto.createVerify('DSS1');
- verify2.update(input);
-
- assert.strictEqual(verify2.verify(dsaPubPem, signature2, 'hex'), true);
- }
} else {
common.printSkipMessage('Skipping unsupported DSA test case');
}
diff --git a/test/parallel/test-crypto-rsa-multiprime-jwk.js b/test/parallel/test-crypto-rsa-multiprime-jwk.js
index be434c76e82..10b25a90f03 100644
--- a/test/parallel/test-crypto-rsa-multiprime-jwk.js
+++ b/test/parallel/test-crypto-rsa-multiprime-jwk.js
@@ -6,13 +6,13 @@ if (!common.hasCrypto)
const assert = require('assert');
const fixtures = require('../common/fixtures');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
const {
createPrivateKey,
} = require('crypto');
const { subtle } = globalThis.crypto;
-if (process.features.openssl_is_boringssl)
+if (isBoringSSL)
common.skip('multi-prime RSA is not available with BoringSSL');
if (hasFIPS())
common.skip('multi-prime RSA is not available in FIPS mode');
diff --git a/test/parallel/test-crypto-rsa-pss-parameters.js b/test/parallel/test-crypto-rsa-pss-parameters.js
index cda01e7a16d..8cc802beec8 100644
--- a/test/parallel/test-crypto-rsa-pss-parameters.js
+++ b/test/parallel/test-crypto-rsa-pss-parameters.js
@@ -2,9 +2,9 @@
const common = require('../common');
if (!common.hasCrypto) common.skip('missing crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3) || isBoringSSL)
- common.skip('requires OpenSSL 3 provider support');
+const { isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
+ common.skip('requires OpenSSL provider support');
const assert = require('assert');
const fixtures = require('../common/fixtures');
diff --git a/test/parallel/test-crypto-sec-level.js b/test/parallel/test-crypto-sec-level.js
index ff32b29bb2b..d4459bc5b75 100644
--- a/test/parallel/test-crypto-sec-level.js
+++ b/test/parallel/test-crypto-sec-level.js
@@ -13,7 +13,7 @@ const assert = require('assert');
// are available by default. Different OpenSSL versions have different
// default security levels and we use this value to adjust what a test
// expects based on the security level. You can read more in
-// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour
+// https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour
// This test simply validates that we can get some value for the secLevel
// when needed by tests.
const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
diff --git a/test/parallel/test-crypto-secure-heap.js b/test/parallel/test-crypto-secure-heap.js
index 22f90b6be99..559879491d6 100644
--- a/test/parallel/test-crypto-secure-heap.js
+++ b/test/parallel/test-crypto-secure-heap.js
@@ -19,7 +19,6 @@ if (common.hasV8Sandbox) {
const {
isBoringSSL,
- hasOpenSSL,
hasFIPS,
} = require('../common/crypto');
@@ -33,7 +32,6 @@ const fixtures = require('../common/fixtures');
const {
secureHeapUsed,
createDiffieHellman,
- getFips,
} = require('crypto');
if (process.argv[2] === 'child') {
@@ -47,8 +45,7 @@ if (process.argv[2] === 'child') {
assert.strictEqual(a.used, 0);
{
- const size = hasFIPS(3) ?
- 2048 : (getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
+ const size = hasFIPS(3) ? 2048 : 1024;
const dh1 = createDiffieHellman(size);
const p1 = dh1.getPrime('buffer');
const dh2 = createDiffieHellman(p1, 'buffer');
diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
index 4b874a7e43f..cb02c4ffd33 100644
--- a/test/parallel/test-crypto-sign-verify.js
+++ b/test/parallel/test-crypto-sign-verify.js
@@ -79,11 +79,9 @@ if (fips30) {
key: keyPem,
padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
});
- }, { message: hasOpenSSL(3) ?
- 'error:1C8000A5:Provider routines::illegal or unsupported padding mode' :
- isBoringSSL ?
- 'error:0600006d:public key routines:OPENSSL_internal:ILLEGAL_OR_UNSUPPORTED_PADDING_MODE' :
- 'bye, bye, error stack' });
+ }, { message: isBoringSSL ?
+ 'error:0600006d:public key routines:OPENSSL_internal:ILLEGAL_OR_UNSUPPORTED_PADDING_MODE' :
+ 'error:1C8000A5:Provider routines::illegal or unsupported padding mode' });
delete Object.prototype.opensslErrorStack;
}
@@ -374,19 +372,12 @@ assert.throws(
key: keyPem,
padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
});
- }, hasOpenSSL(3) ? {
- code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
- message: /illegal or unsupported padding mode/,
- } : isBoringSSL ? {
+ }, isBoringSSL ? {
code: 'ERR_OSSL_EVP_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
message: /ILLEGAL_OR_UNSUPPORTED_PADDING_MODE/,
} : {
- code: 'ERR_OSSL_RSA_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
+ code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
message: /illegal or unsupported padding mode/,
- opensslErrorStack: [
- 'error:06089093:digital envelope routines:EVP_PKEY_CTX_ctrl:' +
- 'command not supported',
- ],
});
}
@@ -682,7 +673,7 @@ if (hasOpenSSL(3, 2)) {
// Preserve the current behavior from https://github.com/nodejs/node/issues/53761:
// one-shot verify does not accept SM2 signatures produced by the streaming path.
-if (hasOpenSSL(3) && crypto.getHashes().includes('sm3')) {
+if (!isBoringSSL && crypto.getHashes().includes('sm3')) {
const data = Buffer.from('AABB');
const privateKey = crypto.createPrivateKey(`-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQgbjCNHopgvyGVfLaP
diff --git a/test/parallel/test-crypto-stream.js b/test/parallel/test-crypto-stream.js
index 9584e48f2cb..8abaf4b8a73 100644
--- a/test/parallel/test-crypto-stream.js
+++ b/test/parallel/test-crypto-stream.js
@@ -28,7 +28,6 @@ if (!common.hasCrypto) {
const assert = require('assert');
const stream = require('stream');
const crypto = require('crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
if (!crypto.getFips()) {
// Small stream to buffer converter
@@ -73,15 +72,10 @@ const cipher = crypto.createCipheriv('aes-128-cbc', key, iv);
const decipher = crypto.createDecipheriv('aes-128-cbc', badkey, iv);
cipher.pipe(decipher)
- .on('error', common.expectsError((hasOpenSSL(3) || isBoringSSL) ? {
+ .on('error', common.expectsError({
message: /bad[\s_]decrypt/i,
library: /Provider routines|Cipher functions/,
reason: /bad[\s_]decrypt/i,
- } : {
- message: /bad[\s_]decrypt/i,
- function: 'EVP_DecryptFinal_ex',
- library: 'digital envelope routines',
- reason: /bad[\s_]decrypt/i,
}));
cipher.end('Papaya!'); // Should not cause an unhandled exception.
diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js
index 1467fd6104d..89525b93370 100644
--- a/test/parallel/test-crypto-x509.js
+++ b/test/parallel/test-crypto-x509.js
@@ -31,7 +31,7 @@ const ca = readFileSync(fixtures.path('keys', 'ca1-cert.pem'));
const privateKey = createPrivateKey(key);
if (!isBoringSSL) {
- const expectedPubkeys = hasOpenSSL(3) ? [
+ const expectedPubkeys = [
[
'rsa_pss_cert_2048.pem',
292,
@@ -42,17 +42,6 @@ if (!isBoringSSL) {
342,
'da0bcd53fbe3969c7cc2730f86abc34e0e1c340264bbdfa3faf01484c2eeece0',
],
- ] : [
- [
- 'rsa_pss_cert_2048.pem',
- 294,
- '4d4f2f076aced4f0df922b84b466b0a60ba4cb50a23d695ae12ddc5fff7aca14',
- ],
- [
- 'rsa_pss_cert_2048_sha256_sha256_16.pem',
- 294,
- 'd37942c3bd02bc25c724fcd31efd647824e536c13d62d9ad0b5db8c0900d3cba',
- ],
];
for (const [name, length, digest] of expectedPubkeys) {
@@ -90,7 +79,7 @@ emailAddress=ry@tinyclouds.org`;
let infoAccessCheck = `OCSP - URI:http://ocsp.nodejs.org/
CA Issuers - URI:http://ca.nodejs.org/ca.cert`;
-if (!hasOpenSSL(3))
+if (isBoringSSL)
infoAccessCheck += '\n';
const der = Buffer.from(
@@ -519,7 +508,7 @@ UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0
assert.strictEqual(child.status, 0, child.stderr || child.stdout);
assert.throws(() => cert.publicKey, {
- message: hasOpenSSL(3) ? /decode error/ : /wrong tag/,
+ message: /decode error/,
name: 'Error'
});
diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
index 3e431c788c6..257c405324c 100644
--- a/test/parallel/test-crypto.js
+++ b/test/parallel/test-crypto.js
@@ -29,7 +29,7 @@ const assert = require('assert');
const crypto = require('crypto');
const tls = require('tls');
const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
const isFips = hasFIPS(3);
// Test Certificates
@@ -244,25 +244,16 @@ assert.throws(() => {
assert(Array.isArray(err.opensslErrorStack));
assert(err.opensslErrorStack.length > 0);
} else {
- if (!hasOpenSSL(3))
- assert.ok(!('opensslErrorStack' in err));
- assert.throws(() => { throw err; }, hasOpenSSL(3) ? {
+ assert.throws(() => { throw err; }, {
name: 'Error',
message: 'error:02000070:rsa routines::digest too big for rsa key',
library: 'rsa routines',
- } : {
- name: 'Error',
- message: /routines:RSA_sign:digest too big for rsa key$/,
- library: /rsa routines/i,
- function: 'RSA_sign',
- reason: /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i,
- code: 'ERR_OSSL_RSA_DIGEST_TOO_BIG_FOR_RSA_KEY'
});
}
return true;
});
-if (!hasOpenSSL(3)) {
+if (isBoringSSL) {
// The correct header inside `rsa_private_pkcs8_bad.pem` should have been
// -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----
// instead of
@@ -270,32 +261,10 @@ if (!hasOpenSSL(3)) {
const sha1_privateKey = fixtures.readKey('rsa_private_pkcs8_bad.pem',
'ascii');
- if (isBoringSSL) {
- // BoringSSL accepts the PKCS#8 payload despite the legacy PEM label.
- const signature = crypto.createSign('sha1').sign(sha1_privateKey);
- assert(Buffer.isBuffer(signature));
- assert.strictEqual(signature.length, 256);
- } else {
- assert.throws(() => {
- // This would inject errors onto OpenSSL's error stack
- crypto.createSign('sha1').sign(sha1_privateKey);
- }, (err) => {
- // Do the standard checks, but then do some custom checks afterwards.
- assert.throws(() => { throw err; }, {
- message: 'error:0D0680A8:asn1 encoding routines:asn1_check_tlen:' +
- 'wrong tag',
- library: 'asn1 encoding routines',
- function: 'asn1_check_tlen',
- reason: 'wrong tag',
- code: 'ERR_OSSL_ASN1_WRONG_TAG',
- });
- // Throws crypto error, so there is an opensslErrorStack property.
- // The openSSL stack should have content.
- assert(Array.isArray(err.opensslErrorStack));
- assert(err.opensslErrorStack.length > 0);
- return true;
- });
- }
+ // BoringSSL accepts the PKCS#8 payload despite the legacy PEM label.
+ const signature = crypto.createSign('sha1').sign(sha1_privateKey);
+ assert(Buffer.isBuffer(signature));
+ assert.strictEqual(signature.length, 256);
}
// Make sure memory isn't released before being returned
diff --git a/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js b/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js
index 0d7366dd343..2ad900cbf35 100644
--- a/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js
+++ b/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js
@@ -26,7 +26,7 @@ const channelName = 'crypto.fips.indicator';
if (!hasOpenSSL(3, 4)) {
common.skip('OpenSSL 3.4 or later is required');
} else if (!hasFIPS(3, 4)) {
- common.skip('an active OpenSSL 3.4+ FIPS provider is required');
+ common.skip('an active OpenSSL FIPS provider is required');
} else if (!process.execArgv.includes('--enable-fips-indicator-events')) {
spawnSyncAndExitWithoutError(
process.execPath,
diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js
index c4edc5b33db..cd82fb0cbb7 100644
--- a/test/parallel/test-https-agent-session-eviction.js
+++ b/test/parallel/test-https-agent-session-eviction.js
@@ -84,7 +84,7 @@ function second(server, session) {
// Offering the cached session to a server using another TLS version should
// not prevent a fresh connection.
req.on('response', common.mustCall(function(res) {
- // The test is now complete for OpenSSL 1.1.0.
+ // The test is now complete.
server.close();
}));
diff --git a/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js b/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js
index ec1b8dda8ca..c9096c570fc 100644
--- a/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js
+++ b/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js
@@ -12,18 +12,9 @@ const fixtures = require('../common/fixtures');
if (!common.hasCrypto)
common.skip('missing crypto');
-const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
-
-// See #37990 for details on why this is problematic with FIPS.
-if (crypto.getFips() === 1 && !hasOpenSSL(3))
- common.skip('Skipping as test uses non-fips compliant EC curve');
-
-// This test will fail for OpenSSL < 1.1.1h
-const minOpenSSL = 269488271;
-
-if (crypto.constants.OPENSSL_VERSION_NUMBER < minOpenSSL)
- common.skip('OpenSSL < 1.1.1h');
+const { isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
+ common.skip('not supported by BoringSSL');
const https = require('https');
const path = require('path');
diff --git a/test/parallel/test-permission-openssl-store.js b/test/parallel/test-permission-openssl-store.js
index b1cfcdc4988..b47553a9e88 100644
--- a/test/parallel/test-permission-openssl-store.js
+++ b/test/parallel/test-permission-openssl-store.js
@@ -4,9 +4,9 @@
const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
-if (!hasOpenSSL(3))
- common.skip('requires OpenSSL 3.x');
+const { isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
+ common.skip('OpenSSL provider support is required');
// Verifies the openssl.store permission: allowed when --allow-openssl-store is
// set, can be dropped at runtime, and denied by default in a child process.
diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
index f5aeec01796..910fec097b6 100644
--- a/test/parallel/test-process-env-allowed-flags-are-documented.js
+++ b/test/parallel/test-process-env-allowed-flags-are-documented.js
@@ -5,7 +5,7 @@ const common = require('../common');
const assert = require('assert');
const fs = require('fs');
const path = require('path');
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
const rootDir = path.resolve(__dirname, '..', '..');
const cliMd = path.join(rootDir, 'doc', 'api', 'cli.md');
@@ -44,7 +44,7 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
}
}
-if (!hasOpenSSL(3)) {
+if (isBoringSSL) {
documented.delete('--openssl-legacy-provider');
documented.delete('--openssl-shared-config');
}
@@ -63,8 +63,8 @@ const conditionalOpts = [
filter: (opt) => {
return [
'--openssl-config',
- hasOpenSSL(3) ? '--openssl-legacy-provider' : '',
- hasOpenSSL(3) ? '--openssl-shared-config' : '',
+ isBoringSSL ? '' : '--openssl-legacy-provider',
+ isBoringSSL ? '' : '--openssl-shared-config',
'--tls-cipher-list',
'--use-bundled-ca',
'--use-openssl-ca',
diff --git a/test/parallel/test-process-versions.js b/test/parallel/test-process-versions.js
index 420625b01f5..9cb122448ed 100644
--- a/test/parallel/test-process-versions.js
+++ b/test/parallel/test-process-versions.js
@@ -104,18 +104,14 @@ assert.match(
assert.match(process.versions.modules, /^\d+$/);
if (common.hasCrypto) {
- const { hasOpenSSL } = require('../common/crypto');
assert.match(process.versions.ncrypto, commonTemplate);
if (process.config.variables.node_shared_openssl) {
assert.ok(process.versions.openssl);
} else {
- const versionRegex = hasOpenSSL(3) ?
- // The following also matches a development version of OpenSSL 3.x which
- // can be in the format '3.0.0-alpha4-dev'. This can be handy when
- // building and linking against the main development branch of OpenSSL.
- /^\d+\.\d+\.\d+(?:[-+][a-z0-9]+)*$/ :
- /^\d+\.\d+\.\d+[a-z]?(\+quic)?(-fips)?$/;
- assert.match(process.versions.openssl, versionRegex);
+ // The following also matches a development version of OpenSSL, such as
+ // '3.0.0-alpha4-dev'. This can be handy when
+ // building and linking against the main development branch of OpenSSL.
+ assert.match(process.versions.openssl, /^\d+\.\d+\.\d+(?:[-+][a-z0-9]+)*$/);
}
}
diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js
index 1b80571e70e..ee1a77c2aa2 100644
--- a/test/parallel/test-tls-alert-handling.js
+++ b/test/parallel/test-tls-alert-handling.js
@@ -5,11 +5,6 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
-const {
- hasOpenSSL,
- isBoringSSL,
-} = require('../common/crypto');
-
const assert = require('assert');
const net = require('net');
const tls = require('tls');
@@ -39,8 +34,6 @@ const errorHandler = common.mustCall((err) => {
assert.match(err.code,
/ERR_SSL_(WRONG_VERSION_NUMBER|PACKET_LENGTH_TOO_LONG|BAD_RECORD_TYPE)/);
assert.strictEqual(err.library, 'SSL routines');
- if (!hasOpenSSL(3) && !isBoringSSL)
- assert.strictEqual(err.function, 'ssl3_get_record');
assert.match(err.reason,
/wrong[\s_]version[\s_]number|packet[\s_]length[\s_]too[\s_]long|bad[\s_]record[\s_]type/i);
errorReceived = true;
@@ -100,8 +93,6 @@ function sendBADTLSRecord() {
assert.match(err.code,
/ERR_SSL_(TLSV1_ALERT_PROTOCOL_VERSION|TLSV1_ALERT_RECORD_OVERFLOW|(SSL\/)?TLS_ALERT_UNEXPECTED_MESSAGE)/);
assert.strictEqual(err.library, 'SSL routines');
- if (!hasOpenSSL(3) && !isBoringSSL)
- assert.strictEqual(err.function, 'ssl3_read_bytes');
assert.match(err.reason,
/tlsv1[\s_]alert[\s_]protocol[\s_]version|tlsv1[\s_]alert[\s_]record[\s_]overflow|(ssl\/)?tls[\s_]alert[\s_]unexpected[\s_]message/i);
}));
diff --git a/test/parallel/test-tls-client-mindhsize.js b/test/parallel/test-tls-client-mindhsize.js
index f08be448dd1..c15ab7e28ee 100644
--- a/test/parallel/test-tls-client-mindhsize.js
+++ b/test/parallel/test-tls-client-mindhsize.js
@@ -8,7 +8,7 @@ if (!common.hasCrypto)
// are available by default. Different OpenSSL versions have different
// default security levels and we use this value to adjust what a test
// expects based on the security level. You can read more in
-// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour
+// https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour
const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
const assert = require('assert');
const tls = require('tls');
diff --git a/test/parallel/test-tls-client-renegotiation-13.js b/test/parallel/test-tls-client-renegotiation-13.js
index 33e74af13ed..b69ddd126e5 100644
--- a/test/parallel/test-tls-client-renegotiation-13.js
+++ b/test/parallel/test-tls-client-renegotiation-13.js
@@ -5,7 +5,7 @@ const common = require('../common');
if (!common.hasCrypto) {
common.skip('missing crypto');
}
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
const fixtures = require('../common/fixtures');
@@ -40,9 +40,7 @@ connect({
});
} else {
assert.throws(() => { throw err; }, {
- message: hasOpenSSL(3) ?
- 'error:0A00010A:SSL routines::wrong ssl version' :
- 'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
+ message: 'error:0A00010A:SSL routines::wrong ssl version',
code: 'ERR_SSL_WRONG_SSL_VERSION',
library: 'SSL routines',
reason: 'wrong ssl version',
diff --git a/test/parallel/test-tls-dhe.js b/test/parallel/test-tls-dhe.js
index 6f54bbd9766..cad14df5529 100644
--- a/test/parallel/test-tls-dhe.js
+++ b/test/parallel/test-tls-dhe.js
@@ -43,7 +43,7 @@ const {
// are available by default. Different OpenSSL versions have different
// default security levels and we use this value to adjust what a test
// expects based on the security level. You can read more in
-// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour
+// https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour
const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
if (!opensslCli) {
@@ -67,7 +67,7 @@ const ciphers = `${dheCipher}:${ecdheCipher}`;
if (secLevel < 2 && !hasFIPS(3)) {
// Test will emit a warning because the DH parameter size is < 2048 bits
- // when the test is run on versions lower than OpenSSL32
+ // when the test is run on OpenSSL versions earlier than 3.2
common.expectWarning('SecurityWarning',
'DH parameter is less than 2048 bits');
}
diff --git a/test/parallel/test-tls-junk-closes-server.js b/test/parallel/test-tls-junk-closes-server.js
index 08c2d39c684..a90fbc60c9b 100644
--- a/test/parallel/test-tls-junk-closes-server.js
+++ b/test/parallel/test-tls-junk-closes-server.js
@@ -42,7 +42,7 @@ server.listen(0, common.mustCall(function() {
c.on('data', function() {
// We must consume all data sent by the server. Otherwise the
// end event will not be sent and the test will hang.
- // For example, when compiled with OpenSSL32 we see the
+ // For example, when compiled with OpenSSL 3.2 we see the
// following response '15 03 03 00 02 02 16' which
// decodes as a fatal (0x02) TLS error alert number 22 (0x16),
// which corresponds to TLS1_AD_RECORD_OVERFLOW which matches
@@ -51,7 +51,7 @@ server.listen(0, common.mustCall(function() {
// but the TLS spec seems to indicate there should be one
// https://datatracker.ietf.org/doc/html/rfc8446#page-85
// and error handling seems to have been re-written/improved
- // in OpenSSL32. Consuming the data allows the test to pass
+ // in OpenSSL 3.2. Consuming the data allows the test to pass
// either way.
});
diff --git a/test/parallel/test-tls-key-mismatch.js b/test/parallel/test-tls-key-mismatch.js
index 8f60ef0520c..fa26419fe5b 100644
--- a/test/parallel/test-tls-key-mismatch.js
+++ b/test/parallel/test-tls-key-mismatch.js
@@ -27,15 +27,13 @@ if (!common.hasCrypto) {
}
const fixtures = require('../common/fixtures');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const tls = require('tls');
const errorMessageRegex = isBoringSSL ?
/^Error: error:0b000074:X\.509 certificate routines:OPENSSL_internal:KEY_VALUES_MISMATCH$/ :
- hasOpenSSL(3) ?
- /^Error: error:05800074:x509 certificate routines::key values mismatch$/ :
- /^Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch$/;
+ /^Error: error:05800074:x509 certificate routines::key values mismatch$/;
const options = {
key: fixtures.readKey('agent1-key.pem'),
diff --git a/test/parallel/test-tls-legacy-pfx.js b/test/parallel/test-tls-legacy-pfx.js
index 77f9c093502..2f3339196f4 100644
--- a/test/parallel/test-tls-legacy-pfx.js
+++ b/test/parallel/test-tls-legacy-pfx.js
@@ -4,10 +4,10 @@ if (!common.hasCrypto) {
common.skip('missing crypto');
}
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3)) {
- common.skip('OpenSSL legacy failures are only testable with OpenSSL 3+');
+if (isBoringSSL) {
+ common.skip('OpenSSL legacy failures are not testable with BoringSSL');
}
const fixtures = require('../common/fixtures');
diff --git a/test/parallel/test-tls-min-max-version.js b/test/parallel/test-tls-min-max-version.js
index 3f91d946c23..ca5698f5181 100644
--- a/test/parallel/test-tls-min-max-version.js
+++ b/test/parallel/test-tls-min-max-version.js
@@ -43,9 +43,9 @@ function test(cmin, cmax, cprot, smin, smax, sprot, proto, cerr, serr) {
}
let ciphers;
- if (hasOpenSSL(3) && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
- proto === 'TLSv1_1_method' || proto === 'TLSv1_method' ||
- sprot === 'TLSv1_1_method' || sprot === 'TLSv1_method')) {
+ if (!isBoringSSL && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
+ proto === 'TLSv1_1_method' || proto === 'TLSv1_method' ||
+ sprot === 'TLSv1_1_method' || sprot === 'TLSv1_method')) {
if (serr !== 'ERR_SSL_UNSUPPORTED_PROTOCOL')
ciphers = 'ALL@SECLEVEL=0';
}
@@ -179,15 +179,11 @@ for (const [method, version] of [
test(U, U, 'TLS_method', U, U, method, ...expected);
}
-// OpenSSL 1.1.1 and 3.0 use a different error code and alert (sent to the
-// client) when no protocols are enabled on the server.
// BoringSSL closes the connection without sending an alert in this case.
const NO_PROTOCOLS_AVAILABLE_SERVER = isBoringSSL ?
- 'ERR_SSL_NO_SUPPORTED_VERSIONS_ENABLED' : hasOpenSSL(3) ?
- 'ERR_SSL_NO_PROTOCOLS_AVAILABLE' : 'ERR_SSL_INTERNAL_ERROR';
+ 'ERR_SSL_NO_SUPPORTED_VERSIONS_ENABLED' : 'ERR_SSL_NO_PROTOCOLS_AVAILABLE';
const NO_PROTOCOLS_AVAILABLE_SERVER_ALERT = isBoringSSL ?
- 'ECONNRESET' : hasOpenSSL(3) ?
- 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION' : 'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR';
+ 'ECONNRESET' : 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION';
const NO_PROTOCOLS_AVAILABLE_CLIENT = isBoringSSL ?
'ERR_SSL_NO_SUPPORTED_VERSIONS_ENABLED' : 'ERR_SSL_NO_PROTOCOLS_AVAILABLE';
const NO_PROTOCOLS_AVAILABLE_CLIENT_ALERT = isBoringSSL ?
diff --git a/test/parallel/test-tls-set-ciphers.js b/test/parallel/test-tls-set-ciphers.js
index 0562c808b8d..6fb071092da 100644
--- a/test/parallel/test-tls-set-ciphers.js
+++ b/test/parallel/test-tls-set-ciphers.js
@@ -1,7 +1,7 @@
'use strict';
const common = require('../common');
if (!common.hasCrypto) {
- common.skip('missing crypto, or OpenSSL version lower than 3');
+ common.skip('missing crypto');
}
const {
@@ -10,10 +10,6 @@ const {
isBoringSSL,
} = require('../common/crypto');
-if (!hasOpenSSL(3) && !isBoringSSL) {
- common.skip('missing crypto, or OpenSSL version lower than 3');
-}
-
const fixtures = require('../common/fixtures');
const { inspect } = require('util');
@@ -154,7 +150,7 @@ if (hasFIPS(3)) {
// TLS_AES_128_CCM_8_SHA256 & TLS_AES_128_CCM_SHA256 are not enabled by
// default, but work.
- // However, for OpenSSL32 AES_128 is not enabled due to the
+ // However, for OpenSSL 3.2 AES_128 is not enabled due to the
// default security level
if (isBoringSSL) {
// BoringSSL does not implement the TLS 1.3 CCM cipher suites.
diff --git a/test/parallel/test-tls13-ciphers.js b/test/parallel/test-tls13-ciphers.js
index 7cf87557e8d..af4cebafbb6 100644
--- a/test/parallel/test-tls13-ciphers.js
+++ b/test/parallel/test-tls13-ciphers.js
@@ -7,7 +7,7 @@ const assert = require('assert');
const { constants } = require('crypto');
const tls = require('tls');
const fixtures = require('../common/fixtures');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
const { spawnSyncAndAssert } = require('../common/child_process');
const { connect, keys } = require(fixtures.path('tls-connect'));
@@ -90,16 +90,10 @@ test(aes128, aes256, undefined);
const duplicates = `${aes256} \t:${aes256}`;
test(duplicates, duplicates, aes256);
-// OpenSSL 1.1.1 rejects unknown TLS 1.3 cipher names. OpenSSL 3 and BoringSSL
-// ignore them and do not interpret exclusion rules in the TLS 1.3 list.
+// Unknown TLS 1.3 cipher names are ignored, and exclusion rules are not
+// interpreted in the TLS 1.3 list.
const list = `TLS_UNKNOWN:!${aes128}:${duplicates}`;
-if (hasOpenSSL(3) || isBoringSSL) {
- test(list, list, aes256);
-} else {
- assert.throws(() => tls.createSecureContext({ ciphers: list }), {
- code: 'ERR_SSL_NO_CIPHER_MATCH',
- });
-}
+test(list, list, aes256);
for (const ciphers of ['TLS_UNKNOWN', `!${aes128}`]) {
assert.throws(() => tls.createSecureContext({ ciphers }), {
code: 'ERR_SSL_NO_CIPHER_MATCH',
diff --git a/test/parallel/test-trace-env.js b/test/parallel/test-trace-env.js
index 4d1a8165277..6c3d144f8ab 100644
--- a/test/parallel/test-trace-env.js
+++ b/test/parallel/test-trace-env.js
@@ -19,8 +19,8 @@ spawnSyncAndAssert(process.execPath, ['--trace-env', fixtures.path('empty.js')],
if (common.hasCrypto) {
assert.match(output, /get "NODE_EXTRA_CA_CERTS"/);
- const { hasOpenSSL } = require('../common/crypto');
- if (hasOpenSSL(3)) {
+ const { isBoringSSL } = require('../common/crypto');
+ if (!isBoringSSL) {
assert.match(output, /get "OPENSSL_CONF"/);
}
}
diff --git a/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js b/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js
index 53db81496b2..7df489b48df 100644
--- a/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js
+++ b/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('assert');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
const { subtle } = globalThis.crypto;
const fips3 = hasFIPS(3);
@@ -56,7 +56,7 @@ if (fips3) {
tests.push(test('ChaCha20-Poly1305', 32, 12, 'raw-secret'));
}
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
tests.push(test(
'AES-OCB',
32,
diff --git a/test/parallel/test-webcrypto-deduplicate-usages.js b/test/parallel/test-webcrypto-deduplicate-usages.js
index 4ef6cbd8d9b..1a1ff8da94b 100644
--- a/test/parallel/test-webcrypto-deduplicate-usages.js
+++ b/test/parallel/test-webcrypto-deduplicate-usages.js
@@ -54,7 +54,7 @@ function assertSameSet(actual, expected, msg) {
symmetric.splice(symmetric.findIndex(({ algorithm }) =>
algorithm.name === 'ChaCha20-Poly1305'), 1);
- if (hasOpenSSL(3)) {
+ if (!isBoringSSL) {
symmetric.push({
algorithm: { name: 'AES-OCB', length: 128 },
usages: ['decrypt', 'encrypt', 'decrypt', 'encrypt'],
@@ -66,7 +66,7 @@ function assertSameSet(actual, expected, msg) {
expected: ['sign', 'verify'],
});
} else {
- common.printSkipMessage('AES-OCB and KMAC require OpenSSL >= 3');
+ common.printSkipMessage('AES-OCB and KMAC are not supported by BoringSSL');
}
for (const { algorithm, usages, expected } of symmetric) {
@@ -178,7 +178,7 @@ function assertSameSet(actual, expected, msg) {
expected: ['wrapKey', 'unwrapKey'] },
];
- if (hasOpenSSL(3)) {
+ if (!isBoringSSL) {
// KMAC does not support `raw` format, only `raw-secret` and `jwk`.
tests.push((async () => {
const key = await subtle.importKey(
@@ -203,7 +203,7 @@ function assertSameSet(actual, expected, msg) {
assert.strictEqual(key.usages.length, 2);
})());
} else {
- common.printSkipMessage('AES-OCB and KMAC require OpenSSL >= 3');
+ common.printSkipMessage('AES-OCB and KMAC are not supported by BoringSSL');
}
for (const { algorithm, keyData, usages, expected } of rawSymmetric) {
@@ -374,7 +374,7 @@ function assertSameSet(actual, expected, msg) {
})());
// AES-OCB raw-secret import.
- if (hasOpenSSL(3)) {
+ if (!isBoringSSL) {
tests.push((async () => {
const imported = subtle.importKey(
'raw-secret',
@@ -393,7 +393,7 @@ function assertSameSet(actual, expected, msg) {
assert.strictEqual(key.usages.length, 2);
})());
} else {
- common.printSkipMessage('AES-OCB requires OpenSSL >= 3');
+ common.printSkipMessage('AES-OCB is not supported by BoringSSL');
}
Promise.all(tests).then(common.mustCall());
@@ -469,7 +469,7 @@ function assertSameSet(actual, expected, msg) {
expected: ['wrapKey', 'unwrapKey'] },
];
- if (hasOpenSSL(3)) {
+ if (!isBoringSSL) {
jwkVectors.push({
algorithm: { name: 'AES-OCB', length: 128 },
usages: ['decrypt', 'encrypt', 'decrypt', 'encrypt'],
@@ -481,7 +481,7 @@ function assertSameSet(actual, expected, msg) {
expected: ['sign', 'verify'],
});
} else {
- common.printSkipMessage('AES-OCB and KMAC require OpenSSL >= 3');
+ common.printSkipMessage('AES-OCB and KMAC are not supported by BoringSSL');
}
for (const { algorithm, usages, expected } of jwkVectors) {
diff --git a/test/parallel/test-webcrypto-derivebits-hkdf.js b/test/parallel/test-webcrypto-derivebits-hkdf.js
index 4fbaa1d7c64..a723b425f07 100644
--- a/test/parallel/test-webcrypto-derivebits-hkdf.js
+++ b/test/parallel/test-webcrypto-derivebits-hkdf.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('assert');
-const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
const { subtle } = globalThis.crypto;
function getDeriveKeyInfo(name, length, hash, ...usages) {
@@ -38,13 +38,13 @@ if (!isBoringSSL) {
common.printSkipMessage('SHA-3 is only supported for digest operations');
}
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
kDerivedKeyTypes.push(
['AES-OCB', 128, undefined, 'encrypt', 'decrypt'],
['AES-OCB', 256, undefined, 'encrypt', 'decrypt'],
);
} else {
- common.printSkipMessage('Skipping unsupported test cases');
+ common.printSkipMessage('Skipping AES-OCB test cases unsupported by BoringSSL');
}
const kDerivedKeys = {
diff --git a/test/parallel/test-webcrypto-derivekey.js b/test/parallel/test-webcrypto-derivekey.js
index a4acb112c6b..49966b5ef80 100644
--- a/test/parallel/test-webcrypto-derivekey.js
+++ b/test/parallel/test-webcrypto-derivekey.js
@@ -6,7 +6,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const { subtle } = globalThis.crypto;
@@ -191,7 +191,7 @@ const fips4 = hasFIPS(4);
common.printSkipMessage('SHA-3 is only supported for digest operations');
}
- if (hasOpenSSL(3)) {
+ if (!isBoringSSL) {
vectors.push(
['KMAC128', 'sign', 128],
[{ name: 'KMAC128', length: 384 }, 'sign', 384],
@@ -251,7 +251,7 @@ const fips4 = hasFIPS(4);
common.printSkipMessage('SHA-3 is only supported for digest operations');
}
- if (hasOpenSSL(3)) {
+ if (!isBoringSSL) {
vectors.push(
['KMAC128', 'sign', 128],
[{ name: 'KMAC128', length: 384 }, 'sign', 384],
@@ -284,7 +284,7 @@ const fips4 = hasFIPS(4);
})().then(common.mustCall());
}
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
(async () => {
const derivedKeyAlgorithm = { name: 'KMAC128', length: 0 };
const usages = ['sign'];
diff --git a/test/parallel/test-webcrypto-encrypt-decrypt-aes.js b/test/parallel/test-webcrypto-encrypt-decrypt-aes.js
index bdf1a1d6666..0789f71cdd7 100644
--- a/test/parallel/test-webcrypto-encrypt-decrypt-aes.js
+++ b/test/parallel/test-webcrypto-encrypt-decrypt-aes.js
@@ -5,7 +5,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const { getFips } = require('crypto');
@@ -230,7 +230,7 @@ async function testDecrypt({ keyBuffer, algorithm, result }) {
}
// Test aes-ocb vectors
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
const {
passing,
failing,
diff --git a/test/parallel/test-webcrypto-encrypt-decrypt.js b/test/parallel/test-webcrypto-encrypt-decrypt.js
index 45d0aa64f72..f68dd404336 100644
--- a/test/parallel/test-webcrypto-encrypt-decrypt.js
+++ b/test/parallel/test-webcrypto-encrypt-decrypt.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('assert');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
const { getFips } = require('crypto');
const { subtle } = globalThis.crypto;
@@ -148,7 +148,7 @@ async function testRSAOaep(publicKey, privateKey) {
}
// Test Encrypt/Decrypt AES-OCB
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
const buf = globalThis.crypto.getRandomValues(new Uint8Array(50));
const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
@@ -180,5 +180,5 @@ if (hasOpenSSL(3)) {
test().then(common.mustCall());
}
} else {
- common.printSkipMessage('Skipping unsupported AES-OCB test cases');
+ common.printSkipMessage('Skipping AES-OCB test cases unsupported by BoringSSL');
}
diff --git a/test/parallel/test-webcrypto-export-import.js b/test/parallel/test-webcrypto-export-import.js
index 4578f7d587d..ad30a5d510e 100644
--- a/test/parallel/test-webcrypto-export-import.js
+++ b/test/parallel/test-webcrypto-export-import.js
@@ -6,7 +6,7 @@ const fixtures = require('../common/fixtures');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
const assert = require('assert');
const { subtle } = globalThis.crypto;
@@ -221,7 +221,7 @@ const {
}
// Import/Export KMAC Secret Key
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
async function test(name) {
const keyData = globalThis.crypto.getRandomValues(new Uint8Array(32));
const key = await subtle.importKey(
diff --git a/test/parallel/test-webcrypto-keygen-kmac.js b/test/parallel/test-webcrypto-keygen-kmac.js
index 999e70df6a6..b51363b79ce 100644
--- a/test/parallel/test-webcrypto-keygen-kmac.js
+++ b/test/parallel/test-webcrypto-keygen-kmac.js
@@ -5,10 +5,10 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3))
- common.skip('requires OpenSSL >= 3');
+if (isBoringSSL)
+ common.skip('KMAC is not supported by BoringSSL');
const assert = require('assert');
const { types: { isCryptoKey } } = require('util');
diff --git a/test/parallel/test-webcrypto-keygen.js b/test/parallel/test-webcrypto-keygen.js
index 6618a43db74..9d484f1c3b5 100644
--- a/test/parallel/test-webcrypto-keygen.js
+++ b/test/parallel/test-webcrypto-keygen.js
@@ -177,7 +177,7 @@ if (!isBoringSSL) {
common.printSkipMessage('Skipping unsupported test cases');
}
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
vectors['AES-OCB'] = {
algorithm: { length: 256 },
result: 'CryptoKey',
diff --git a/test/parallel/test-webcrypto-kmac-empty-output.js b/test/parallel/test-webcrypto-kmac-empty-output.js
index fe88f7ab769..a1783ec64d4 100644
--- a/test/parallel/test-webcrypto-kmac-empty-output.js
+++ b/test/parallel/test-webcrypto-kmac-empty-output.js
@@ -5,10 +5,10 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasFIPS, hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3))
- common.skip('requires OpenSSL >= 3');
+if (isBoringSSL)
+ common.skip('KMAC is not supported by BoringSSL');
if (hasFIPS())
common.skip('empty KMAC output is not supported in FIPS mode');
diff --git a/test/parallel/test-webcrypto-sign-verify-kmac.js b/test/parallel/test-webcrypto-sign-verify-kmac.js
index 5829ab3685c..312431b4f06 100644
--- a/test/parallel/test-webcrypto-sign-verify-kmac.js
+++ b/test/parallel/test-webcrypto-sign-verify-kmac.js
@@ -5,10 +5,10 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3))
- common.skip('requires OpenSSL >= 3');
+if (isBoringSSL)
+ common.skip('KMAC is not supported by BoringSSL');
const assert = require('assert');
const { subtle } = globalThis.crypto;
diff --git a/test/parallel/test-webcrypto-sign-verify.js b/test/parallel/test-webcrypto-sign-verify.js
index 295f1378238..70148ee28ae 100644
--- a/test/parallel/test-webcrypto-sign-verify.js
+++ b/test/parallel/test-webcrypto-sign-verify.js
@@ -109,7 +109,7 @@ const { subtle } = globalThis.crypto;
}
// Test Sign/Verify KMAC
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
async function test(name, data) {
const ec = new TextEncoder();
diff --git a/test/parallel/test-webcrypto-supports-fips.js b/test/parallel/test-webcrypto-supports-fips.js
index e08551c65f3..470c776933e 100644
--- a/test/parallel/test-webcrypto-supports-fips.js
+++ b/test/parallel/test-webcrypto-supports-fips.js
@@ -3,8 +3,8 @@
const common = require('../common');
if (!common.hasCrypto) common.skip('missing crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3) || isBoringSSL) common.skip('requires OpenSSL 3');
+const { isBoringSSL } = require('../common/crypto');
+if (isBoringSSL) common.skip('requires an OpenSSL provider');
const assert = require('node:assert');
const crypto = require('node:crypto');
diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js
index 84024462204..5abc9fb06db 100644
--- a/test/parallel/test-webcrypto-wrap-unwrap.js
+++ b/test/parallel/test-webcrypto-wrap-unwrap.js
@@ -60,7 +60,7 @@ const kWrappingData = {
if (fips3)
delete kWrappingData['ChaCha20-Poly1305'];
-if (hasOpenSSL(3) && !fips3) {
+if (!isBoringSSL && !fips3) {
kWrappingData['AES-OCB'] = {
generate: { length: 128 },
wrap: {
@@ -484,7 +484,7 @@ async function testNonByteLengthWrapUnwrap({
implicitAlgorithm: hmacAlgorithm,
});
- if (hasOpenSSL(3) && getFips() !== 1) {
+ if (!isBoringSSL && getFips() !== 1) {
for (const name of ['KMAC128', 'KMAC256']) {
const keyData = new Uint8Array(32).fill(0xff);
const kmacKey = await subtle.importKey(
diff --git a/test/parallel/test-x509-escaping.js b/test/parallel/test-x509-escaping.js
index daa51e28191..c48b846e905 100644
--- a/test/parallel/test-x509-escaping.js
+++ b/test/parallel/test-x509-escaping.js
@@ -59,8 +59,8 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
'IP Address:8.8.8.8',
'IP Address:8.8.4.4',
// For backward-compatibility, include invalid IP address lengths.
- hasOpenSSL(3) ? 'IP Address:<invalid length=5>' : 'IP Address:<invalid>',
- hasOpenSSL(3) ? 'IP Address:<invalid length=6>' : 'IP Address:<invalid>',
+ isBoringSSL ? 'IP Address:<invalid>' : 'IP Address:<invalid length=5>',
+ isBoringSSL ? 'IP Address:<invalid>' : 'IP Address:<invalid length=6>',
// IPv6 addresses are represented as OpenSSL does.
'IP Address:A0B:C0D:E0F:0:0:0:7A7B:7C7D',
// Regular email addresses don't require escaping.
@@ -88,22 +88,22 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
// This is an OID that will likely never be assigned to anything, thus
// OpenSSL should not know it.
'Registered ID:1.3.9999.12.34',
- hasOpenSSL(3) ?
+ !isBoringSSL ?
'othername:XmppAddr:abc123' :
'othername:<unsupported>',
- hasOpenSSL(3) ?
+ !isBoringSSL ?
'othername:"XmppAddr:abc123\\u002c DNS:good.example.com"' :
'othername:<unsupported>',
- hasOpenSSL(3) ?
+ !isBoringSSL ?
'othername:"XmppAddr:good.example.com\\u0000abc123"' :
'othername:<unsupported>',
// This is unsupported because the OID is not recognized.
'othername:<unsupported>',
- hasOpenSSL(3) ? 'othername:SRVName:abc123' : 'othername:<unsupported>',
+ isBoringSSL ? 'othername:<unsupported>' : 'othername:SRVName:abc123',
// This is unsupported because it is an SRVName with a UTF8String value,
// which is not allowed for SRVName.
'othername:<unsupported>',
- hasOpenSSL(3) ?
+ !isBoringSSL ?
'othername:"SRVName:abc\\u0000def"' :
'othername:<unsupported>',
];
@@ -173,7 +173,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
],
},
},
- hasOpenSSL(3) ? {
+ !isBoringSSL ? {
text: 'OCSP - othername:XmppAddr:good.example.com\n' +
'OCSP - othername:<unsupported>\n' +
'OCSP - othername:SRVName:abc123',
@@ -196,7 +196,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
],
},
},
- hasOpenSSL(3) ? {
+ !isBoringSSL ? {
text: 'OCSP - othername:"XmppAddr:good.example.com\\u0000abc123"',
legacy: {
'OCSP - othername': [
@@ -222,7 +222,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
// Test the subjectAltName property of the X509Certificate API.
const cert = new X509Certificate(pem);
assert.strictEqual(cert.infoAccess,
- `${expected.text}${hasOpenSSL(3) ? '' : '\n'}`);
+ `${expected.text}${isBoringSSL ? '\n' : ''}`);
// Test that the certificate obtained by checkServerIdentity has the correct
// subjectaltname property.
diff --git a/test/pummel/test-crypto-dh-hash.js b/test/pummel/test-crypto-dh-hash.js
index e428df491a3..f61fd5bf3ea 100644
--- a/test/pummel/test-crypto-dh-hash.js
+++ b/test/pummel/test-crypto-dh-hash.js
@@ -30,10 +30,10 @@ if (common.isPi()) {
common.skip('Too slow for Raspberry Pi devices');
}
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3)) {
- common.skip('Too slow when dynamically linked against OpenSSL 1.1.1');
+if (isBoringSSL) {
+ common.skip('BoringSSL does not support all tested MODP groups');
}
const assert = require('assert');
diff --git a/test/pummel/test-dh-regr.js b/test/pummel/test-dh-regr.js
index 8a2e71745a3..b5a1995ffef 100644
--- a/test/pummel/test-dh-regr.js
+++ b/test/pummel/test-dh-regr.js
@@ -32,7 +32,7 @@ if (common.isPi()) {
const assert = require('assert');
const crypto = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
let iterations = 2000;
if (hasFIPS(3)) {
@@ -46,11 +46,11 @@ if (hasFIPS(3)) {
}
let createDH;
-if (hasOpenSSL(3)) {
- // OpenSSL 3 recognizes named groups without validating their primes.
+if (!isBoringSSL) {
+ // OpenSSL recognizes named groups without validating their primes.
createDH = () => crypto.getDiffieHellman('modp14');
} else {
- // Other backends validate each peer's parameters, so keep them small.
+ // BoringSSL validates each peer's parameters, so keep them small.
const length = crypto.getFips() === 1 ? 1024 : 256;
const prime = crypto.createDiffieHellman(length).getPrime();
createDH = () => crypto.createDiffieHellman(prime);
diff --git a/test/wpt/status/WebCryptoAPI.cjs b/test/wpt/status/WebCryptoAPI.cjs
index 4e8e4efd882..be5ee9c9e54 100644
--- a/test/wpt/status/WebCryptoAPI.cjs
+++ b/test/wpt/status/WebCryptoAPI.cjs
@@ -30,7 +30,7 @@ function skipSubtests(...entries) {
}
}
-if (!hasOpenSSL(3, 0)) {
+if (isBoringSSL) {
skip(
'modern-algos/encrypt_decrypt/aes_ocb.https.any.js',
'modern-algos/generateKey/failures_AES-OCB.https.any.js',