src: update OpenSSL pqc checks

[panva]

The existing checks would not be true for OpenSSL 4.0.0 up until 4.5.0.

[nodejs-github-bot]

Review requested:

• @nodejs/crypto
• @nodejs/security-wg

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/68540/

[panva]

@richardlau I would expect this to pass on the node-test-linux-linked-openssl35 job, does the version in there not match #if OPENSSL_VERSION_NUMBER >= 0x3050000fL?

It's probably one of the pre-releases isn't it, so not f for final release.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/68542/

[richardlau]

@richardlau I would expect this to pass on the node-test-linux-linked-openssl35 job, does the version in there not match #if OPENSSL_VERSION_NUMBER >= 0x3050000fL?

It's probably one of the pre-releases isn't it, so not f for final release.

I'll need to double check, but it should be be the released OpenSSL 3.5.0: https://github.com/nodejs/build/blob/cf880efe5019506af912b117587abf07888bc5fa/ansible/roles/docker/templates/ubuntu2204_sharedlibs.Dockerfile.j2#L127-L136

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/68546/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/68551/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/68553/

[panva]

I would expect this to pass on the node-test-linux-linked-openssl35 job, does the version in there not match #if OPENSSL_VERSION_NUMBER >= 0x3050000fL?
It's probably one of the pre-releases isn't it, so not f for final release.

I'll need to double check, but it should be be the released OpenSSL 3.5.0: https://github.com/nodejs/build/blob/cf880efe5019506af912b117587abf07888bc5fa/ansible/roles/docker/templates/ubuntu2204_sharedlibs.Dockerfile.j2#L127-L136

Strange. Why did the version check with an f not work?

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/68554/

[richardlau]

I would expect this to pass on the node-test-linux-linked-openssl35 job, does the version in there not match #if OPENSSL_VERSION_NUMBER >= 0x3050000fL?
It's probably one of the pre-releases isn't it, so not f for final release.

I'll need to double check, but it should be be the released OpenSSL 3.5.0: https://github.com/nodejs/build/blob/cf880efe5019506af912b117587abf07888bc5fa/ansible/roles/docker/templates/ubuntu2204_sharedlibs.Dockerfile.j2#L127-L136

Strange. Why did the version check with an f not work?

@panva I agree this is strange, but looking at the OpenSSL headers, I'm not sure how one would get an f for final release. Maybe this is an upstream OpenSSL bug (or feature if they want to make it really hard to mark an openssl installation as release when building from source from the release tarball)?

If I look in the container that the failing build was run in I see these definitions (configure --prefix... with the tarball for OpenSSL 3.5.0):

/*
 * SECTION 1: VERSION DATA.  These will change for each release
 */

/*
 * Base version macros
 *
 * These macros express version number MAJOR.MINOR.PATCH exactly
 */
# define OPENSSL_VERSION_MAJOR  3
# define OPENSSL_VERSION_MINOR  5
# define OPENSSL_VERSION_PATCH  0

/*
 * Additional version information
 *
 * These are also part of the new version scheme, but aren't part
 * of the version number itself.
 */

/* Could be: #define OPENSSL_VERSION_PRE_RELEASE "-alpha.1" */
# define OPENSSL_VERSION_PRE_RELEASE ""
/* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
/* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
# define OPENSSL_VERSION_BUILD_METADATA ""
...
/* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
# ifdef OPENSSL_VERSION_PRE_RELEASE
#  define _OPENSSL_VERSION_PRE_RELEASE 0x0L
# else
#  define _OPENSSL_VERSION_PRE_RELEASE 0xfL
# endif
# define OPENSSL_VERSION_NUMBER          \
    ( (OPENSSL_VERSION_MAJOR<<28)        \
      |(OPENSSL_VERSION_MINOR<<20)       \
      |(OPENSSL_VERSION_PATCH<<4)        \
      |_OPENSSL_VERSION_PRE_RELEASE )

i.e. OPENSSL_VERSION_PRE_RELEASE is defined as an empty string "" but would then cause _OPENSSL_VERSION_PRE_RELEASE to be defined as 0x0L (because OPENSSL_VERSION_PRE_RELEASE is defined).

opensslv.h is templated, and the template doesn't appear to have a mechanism to not have the macro defined (e.g. comment out the definition, or unset it) so it would always appear to be defined to something (empty string or value):

node/deps/openssl/openssl/include/openssl/opensslv.h.in

Lines 40 to 41 in b87312b

	/* Could be: #define OPENSSL_VERSION_PRE_RELEASE "-alpha.1" */
	# define OPENSSL_VERSION_PRE_RELEASE "{- $config{prerelease} -}"

This is consistent with, the opensslv.h from our bundled copy of OpenSSL, deps/openssl/config, e.g.

node/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h

Line 42 in b87312b

# define OPENSSL_VERSION_PRE_RELEASE ""

(I think the original check only worked for the bundled OpenSSL because it was OpenSSL 3.5.1 and not OpenSSL 3.5.0) but also:

• Ubuntu 24.04 (with OpenSSL 3.0.13)
• Fedora 42 (OpenSSL 3.5.1)

which all contain an empty string definition for OPENSSL_VERSION_PRE_RELEASE.

[richardlau]

I agree this is strange, but looking at the OpenSSL headers, I'm not sure how one would get an f for final release. Maybe this is an upstream OpenSSL bug

I convinced myself it is a bug and reported it, openssl/openssl#28227. openssl/openssl#28230 was opened to address.

[nodejs-github-bot]

Landed in db18bc8