src: pull in more electron boringssl adjustments

Electron has a number of patches they float in order to
build node.js with boringssl. We already incorporate some
of those, this brings in more of them.

Author: jasnell

src/crypto/crypto_cipher.cc

@@ -993,11 +993,15 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
       return ThrowCryptoError(env, ERR_get_error());
     }
 
+#ifndef OPENSSL_IS_BORINGSSL
+    // RSA implicit rejection here is not supported by BoringSSL.
+    // Skip this check when boring is used.
     if (!ctx.setRsaImplicitRejection()) {
       return THROW_ERR_INVALID_ARG_VALUE(
           env,
           "RSA_PKCS1_PADDING is no longer supported for private decryption");
     }
+#endif
   }
 
   const EVP_MD* digest = nullptr;

src/crypto/crypto_dh.cc

@@ -7,7 +7,9 @@
 #include "memory_tracker-inl.h"
 #include "ncrypto.h"
 #include "node_errors.h"
+#ifndef OPENSSL_IS_BORINGSSL
 #include "openssl/bnerr.h"
+#endif
 #include "openssl/dh.h"
 #include "threadpoolwork-inl.h"
 #include "v8.h"
@@ -88,11 +90,15 @@ void New(const FunctionCallbackInfo<Value>& args) {
   if (args[0]->IsInt32()) {
     int32_t bits = args[0].As<Int32>()->Value();
     if (bits < 2) {
+#ifndef OPENSSL_IS_BORINGSSL
 #if OPENSSL_VERSION_MAJOR >= 3
       ERR_put_error(ERR_LIB_DH, 0, DH_R_MODULUS_TOO_SMALL, __FILE__, __LINE__);
 #else
       ERR_put_error(ERR_LIB_BN, 0, BN_R_BITS_TOO_SMALL, __FILE__, __LINE__);
-#endif
+#endif  // OPENSSL_VERSION_MAJOR >= 3
+#else  // OPENSSL_IS_BORINGSSL
+      OPENSSL_PUT_ERROR(BN, BN_R_BITS_TOO_SMALL);
+#endif  // OPENSSL_IS_BORINGSSL
       return ThrowCryptoError(env, ERR_get_error(), "Invalid prime length");
     }
 
@@ -105,7 +111,11 @@ void New(const FunctionCallbackInfo<Value>& args) {
     }
     int32_t generator = args[1].As<Int32>()->Value();
     if (generator < 2) {
+#ifndef OPENSSL_IS_BORINGSSL
       ERR_put_error(ERR_LIB_DH, 0, DH_R_BAD_GENERATOR, __FILE__, __LINE__);
+#else
+      OPENSSL_PUT_ERROR(DH, DH_R_BAD_GENERATOR);
+#endif
       return ThrowCryptoError(env, ERR_get_error(), "Invalid generator");
     }
 
@@ -134,12 +144,20 @@ void New(const FunctionCallbackInfo<Value>& args) {
   if (args[1]->IsInt32()) {
     int32_t generator = args[1].As<Int32>()->Value();
     if (generator < 2) {
+#ifndef OPENSSL_IS_BORINGSSL
       ERR_put_error(ERR_LIB_DH, 0, DH_R_BAD_GENERATOR, __FILE__, __LINE__);
+#else
+      OPENSSL_PUT_ERROR(DH, DH_R_BAD_GENERATOR);
+#endif
       return ThrowCryptoError(env, ERR_get_error(), "Invalid generator");
     }
     bn_g = BignumPointer::New();
     if (!bn_g.setWord(generator)) {
+#ifndef OPENSSL_IS_BORINGSSL
       ERR_put_error(ERR_LIB_DH, 0, DH_R_BAD_GENERATOR, __FILE__, __LINE__);
+#else
+      OPENSSL_PUT_ERROR(DH, DH_R_BAD_GENERATOR);
+#endif
       return ThrowCryptoError(env, ERR_get_error(), "Invalid generator");
     }
   } else {
@@ -148,11 +166,19 @@ void New(const FunctionCallbackInfo<Value>& args) {
       return THROW_ERR_OUT_OF_RANGE(env, "generator is too big");
     bn_g = BignumPointer(reinterpret_cast<uint8_t*>(arg1.data()), arg1.size());
     if (!bn_g) {
+#ifndef OPENSSL_IS_BORINGSSL
       ERR_put_error(ERR_LIB_DH, 0, DH_R_BAD_GENERATOR, __FILE__, __LINE__);
+#else
+      OPENSSL_PUT_ERROR(DH, DH_R_BAD_GENERATOR);
+#endif
       return ThrowCryptoError(env, ERR_get_error(), "Invalid generator");
     }
     if (bn_g.getWord() < 2) {
+#ifndef OPENSSL_IS_BORINGSSL
       ERR_put_error(ERR_LIB_DH, 0, DH_R_BAD_GENERATOR, __FILE__, __LINE__);
+#else
+      OPENSSL_PUT_ERROR(DH, DH_R_BAD_GENERATOR);
+#endif
       return ThrowCryptoError(env, ERR_get_error(), "Invalid generator");
     }
   }
@@ -398,14 +424,19 @@ EVPKeyCtxPointer DhKeyGenTraits::Setup(DhKeyPairGenConfig* params) {
     if (!dh) return {};
 
     key_params = EVPKeyPointer::NewDH(std::move(dh));
-  } else if (int* prime_size = std::get_if<int>(&params->params.prime)) {
+  } else if (std::get_if<int>(&params->params.prime)) {
     auto param_ctx = EVPKeyCtxPointer::NewFromID(EVP_PKEY_DH);
+#ifndef OPENSSL_IS_BORINGSSL
+    int* prime_size = std::get_if<int>(&params->params.prime);
     if (!param_ctx.initForParamgen() ||
         !param_ctx.setDhParameters(*prime_size, params->params.generator)) {
       return {};
     }
 
     key_params = param_ctx.paramgen();
+#else
+    return {};
+#endif
   } else {
     UNREACHABLE();
   }

src/crypto/crypto_dsa.cc

@@ -29,6 +29,10 @@ using v8::Value;
 
 namespace crypto {
 EVPKeyCtxPointer DsaKeyGenTraits::Setup(DsaKeyPairGenConfig* params) {
+#ifdef OPENSSL_IS_BORINGSSL
+  // Operation is unsupported in BoringSSL
+  return {};
+#else
   auto param_ctx = EVPKeyCtxPointer::NewFromID(EVP_PKEY_DSA);
 
   if (!param_ctx.initForParamgen() ||
@@ -46,6 +50,7 @@ EVPKeyCtxPointer DsaKeyGenTraits::Setup(DsaKeyPairGenConfig* params) {
   EVPKeyCtxPointer key_ctx = key_params.newCtx();
   if (!key_ctx.initForKeygen()) return {};
   return key_ctx;
+#endif
 }
 
 // Input arguments for DsaKeyPairGenJob

src/crypto/crypto_keys.cc

@@ -950,6 +950,10 @@ void KeyObjectHandle::GetAsymmetricKeyType(
 }
 
 bool KeyObjectHandle::CheckEcKeyData() const {
+#ifdef OPENSSL_IS_BORINGSSL
+  // Operation is unsupported on BoringSSL
+  return true;
+#else
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
   const auto& key = data_.GetAsymmetricKey();
@@ -962,6 +966,7 @@ bool KeyObjectHandle::CheckEcKeyData() const {
   }
 
   return ctx.publicCheck();
+#endif
 }
 
 void KeyObjectHandle::CheckEcKeyData(const FunctionCallbackInfo<Value>& args) {

src/crypto/crypto_util.cc

@@ -680,29 +680,46 @@ void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
   CHECK(args[0]->IsUint32());
   Environment* env = Environment::GetCurrent(args);
   uint32_t len = args[0].As<Uint32>()->Value();
+#ifndef OPENSSL_IS_BORINGSSL
   void* data = OPENSSL_secure_zalloc(len);
+#else
+  void* data = OPENSSL_malloc(len);
+#endif
   if (data == nullptr) {
     // There's no memory available for the allocation.
     // Return nothing.
     return;
   }
+#ifdef OPENSSL_IS_BORINGSSL
+  memset(data, 0, len);
+#endif
   std::shared_ptr<BackingStore> store =
       ArrayBuffer::NewBackingStore(
           data,
           len,
           [](void* data, size_t len, void* deleter_data) {
+#ifndef OPENSSL_IS_BORINGSSL
             OPENSSL_secure_clear_free(data, len);
+#else
+            OPENSSL_clear_free(data, len);
+#endif
           },
           data);
   Local<ArrayBuffer> buffer = ArrayBuffer::New(env->isolate(), store);
   args.GetReturnValue().Set(Uint8Array::New(buffer, 0, len));
 }
 
 void SecureHeapUsed(const FunctionCallbackInfo<Value>& args) {
+#ifndef OPENSSL_IS_BORINGSSL
   Environment* env = Environment::GetCurrent(args);
   if (CRYPTO_secure_malloc_initialized())
     args.GetReturnValue().Set(
         BigInt::New(env->isolate(), CRYPTO_secure_used()));
+#else
+  // BoringSSL does not have the secure heap and therefore
+  // will always return 0.
+  args.GetReturnValue().Set(BigInt::New(args.GetIsolate(), 0));
+#endif
 }
 }  // namespace