crypto: add a generic MAC API - #65553
Conversation
|
Review requested:
|
|
Compared
|
|
Based on the referenced issues and prior work: cc @bnoordhuis @mscdex @tniessen @paragonie-security |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #65553 +/- ##
==========================================
- Coverage 90.07% 90.05% -0.03%
==========================================
Files 751 754 +3
Lines 254921 255653 +732
Branches 48129 48295 +166
==========================================
+ Hits 229627 230225 +598
- Misses 16479 16554 +75
- Partials 8815 8874 +59
🚀 New features to boost your workflow:
|
|
The
notable-change
Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section. |
|
Benchmark GHA (crypto / mac): https://github.com/nodejs/node/actions/runs/33089847500 Results
Benchmark results:
|
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment was marked as outdated.
This comment was marked as outdated.
This comment has been minimized.
This comment has been minimized.
|
I don't know what to do about these consistent crypto unrelated failures on |
This is a deterministic ELF-layout bug in legacy
The kernel diagnostic was:
See nodejs/build#4433. Why it happens on every resumeThe failure is layout-dependent, not random. Rebuilding the same source with the same RHEL8 compiler/linker produces the same ELF layout, so postject selects the same problematic gap every time. Across different commits it may appear intermittent, but for this particular PR layout it is consistently reproducible. Previous runs
The failure followed the RHEL8 label across IBM and DigitalOcean workers, while adjacent unrelated RHEL8 builds passed. Why the existing fix does not cover itNode.js PR #65564 fixes this for the native These two tests still use Proper fixEither:
Repeated resumes, rebasing onto the same main revision, or changing code size may alter the layout accidentally, but none addresses the underlying bug. |
Add getMacs() and createMac() to node:crypto as a layer on top of OpenSSL EVP_MAC. Support incremental and streaming operations with provider parameter validation and configurable output sizes. Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Migrate the remaining SEA tests away from postject. This routes ELF generation through --build-sea, which keeps PT_LOAD segments on separate pages for compatibility with RHEL 8 kernels. Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com>
76541f0 to
47e37e6
Compare
Add getMacs() and createMac() to node:crypto as a layer on top of OpenSSL EVP_MAC. Support incremental and streaming operations with provider parameter validation and configurable output sizes. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65553 Refs: #32433 Refs: #40921 Refs: #48314 Refs: #32448 Refs: #32477 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Migrate the remaining SEA tests away from postject. This routes ELF generation through --build-sea, which keeps PT_LOAD segments on separate pages for compatibility with RHEL 8 kernels. Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65553 Refs: #32433 Refs: #40921 Refs: #48314 Refs: #32448 Refs: #32477 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
|
Landed in 4215cc3...249e6ff |
Migrate the remaining SEA tests away from postject. This routes ELF generation through --build-sea, which keeps PT_LOAD segments on separate pages for compatibility with RHEL 8 kernels. Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#65553 Refs: nodejs/build#4433 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Add getMacs() and createMac() to node:crypto as a layer on top of OpenSSL EVP_MAC. Support incremental and streaming operations with provider parameter validation and configurable output sizes. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65553 Refs: #32433 Refs: #40921 Refs: #48314 Refs: #32448 Refs: #32477 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Migrate the remaining SEA tests away from postject. This routes ELF generation through --build-sea, which keeps PT_LOAD segments on separate pages for compatibility with RHEL 8 kernels. Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65553 Refs: nodejs/build#4433 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Add getMacs() and createMac() to node:crypto as a layer on top of OpenSSL EVP_MAC. Support incremental and streaming operations with provider parameter validation and configurable output sizes.
Refs: #32433
Refs: #40921
Refs: #48314
Refs: #32448
Refs: #32477
Possible followups:
mac.copy([options])to get a new Mac instance with a copied state, not for GMAC and Poly1305crypto.mac(algorithm, key, data[, options])one-shot akin tocrypto.hash()