[v26.x backport] crypto: discover hashes and ciphers from providers - #65596
Open
panva wants to merge 2 commits into
Open
[v26.x backport] crypto: discover hashes and ciphers from providers#65596panva wants to merge 2 commits into
panva wants to merge 2 commits into
Conversation
Enumerate usable digests and aliases from activated OpenSSL 3 providers rather than relying only on the legacy digest registry. Normalize provider aliases, omit numeric OIDs and NULL, and validate them against the active default property query. Preserve legacy names and the OpenSSL 1.1.1 and BoringSSL paths. Expose KECCAK-KMAC-128, KECCAK-256, SHA256-192, and other provider digests. Add `functionName` and `customization` options for cSHAKE digests in `createHash()` and `crypto.hash()` with OpenSSL 4.0 or later. Resolve provider-only digest names across hashing, HMAC, KDF, signing, verification, and RSA digest options. Keep ordinary hash construction and one-shot hashing on the original binding arities and direct initialization paths. Use parameterized setup only when cSHAKE options are supplied. Lazily cache successful provider fetches per Environment. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Introduce a process-wide FIPS-state generation that advances only after successful, state-changing `setFips()` calls. Use it to invalidate per-Environment digest caches and refresh `getHashes()` snapshots in the main thread and workers. Keep cache IDs monotonic across invalidation because JavaScript Realms can retain them. Existing hash contexts can finish across a transition. Release provider owners before unloading worker addon DSOs. Document provider-dependent availability and operation-specific restrictions. Add known-answer vectors, option validation, provider resolution, property-query, FIPS transition, worker, snapshot, and cross-API coverage. Refs: nodejs#62982 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#65484 Fixes: nodejs#43040 Fixes: nodejs#64866 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Enumerate usable ciphers and aliases from activated OpenSSL 3 providers instead of maintaining lists of provider-only algorithms. Skip numeric OID aliases and filter NULL, TLS composite, multiblock, and encrypt-then-MAC implementations that the Cipher APIs cannot use. Preserve the OpenSSL 1.1.1 and BoringSSL paths. Expose CBC-CTS, SM4-GCM, SM4-CCM, SM4-XTS, and additional AES key wrap implementations. Add `ctsMode` (CS1/CS2/CS3) and `xtsStandard` (GB/IEEE) options for selecting provider CTS and SM4-XTS variants. Keep ordinary cipher construction on the original binding and legacy lookup paths. Lazily cache successful provider fetches per Environment for string initialization and `getCipherInfo()`. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Use the shared process-wide FIPS-state generation to invalidate per-Environment cipher caches and refresh `getCiphers()` snapshots in the main thread and workers. Existing cipher contexts retain their implementation and can finish across a transition. Release provider owners before unloading worker addon DSOs. Enforce one-shot updates for CBC-CTS, AES key wrap, SIV/GCM-SIV, and CCM decryption. Reject finalization without required input or CCM tags, and defer authentication failures to `final()`. Document streaming and XTS data-unit constraints. Add known-answer vectors, option validation, provider round trips, cache, worker, snapshot, FIPS transition, and construction benchmark coverage. Fixes: nodejs#43040 Fixes: nodejs#64866 Refs: nodejs#62982 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#65484 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Collaborator
|
Review requested:
|
nodejs-github-bot
added
lib / src
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## v26.x-staging #65596 +/- ##
=================================================
+ Coverage 90.24% 90.34% +0.10%
=================================================
Files 729 744 +15
Lines 242760 250889 +8129
Branches 46044 47899 +1855
=================================================
+ Hits 219073 226673 +7600
- Misses 15133 15515 +382
- Partials 8554 8701 +147
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports #65484 to v26.x