crypto: split OpenSSL 3, BoringSSL, and legacy backends

This separates the native crypto backend paths for OpenSSL >= 3,
BoringSSL, and legacy OpenSSL. The OpenSSL >= 3 path now builds with
`OPENSSL_API_COMPAT=30000` and `OPENSSL_NO_DEPRECATED`, moving normal
crypto/TLS code away from APIs that OpenSSL 3.0.0 marks deprecated.
BoringSSL remains on its own branch, and OpenSSL < 3 remains the legacy
fallback.
The exception is ENGINE support. ENGINE APIs are isolated into a
dedicated compatibility target so they can remain available while the
JS-facing engine APIs are runtime-deprecated in 27.x. That gives us a
clear removal point for 28.x, without letting ENGINE usage leak back
into the strict OpenSSL 3 path.
The split also makes the eventual OpenSSL 1.1.1 removal easier to reason
about. Once support for OpenSSL < 3 is dropped, the legacy branch can be
removed in a focused follow-up, possibly targeting 27.x, instead of
untangling mixed version guards throughout the crypto implementation.
No public crypto or TLS API behavior is intentionally changed.
Assisted-by: Codex:gpt-5
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #64211
Backport-PR-URL: #65087
Refs: #56733
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: panva

common.gypi

@@ -24,6 +24,7 @@
 'node_module_version%': '',
 'node_with_ltcg%': '',
 'node_shared_openssl%': 'false',
+'openssl_is_boringssl%': 'false',
 
 'node_tag%': '',
 'uv_library%': 'static_library',

configure.py

@@ -1328,50 +1328,72 @@ def get_gas_version(cc):
 warn(f'Could not recognize `gas`: {gas_ret}')
 return'0.0'
 
-defget_openssl_version():
+defget_openssl_macros(o):
+"""Extract OpenSSL preprocessor macros from the configured headers."""
+
+# Use the C compiler to extract preprocessor macros from OpenSSL headers.
+# crypto.h is included because BoringSSL declares OPENSSL_IS_BORINGSSL there.
+args= ['-E', '-dM',
+'-include', 'openssl/opensslv.h',
+'-include', 'openssl/crypto.h',
+'-']
+ifnotoptions.shared_openssl:
+args= ['-I', 'deps/openssl/openssl/include'] +args
+elifoptions.shared_openssl_includes:
+args= ['-I', options.shared_openssl_includes] +args
+else:
+fordirino['include_dirs']:
+args= ['-I', dir] +args
+
+proc=subprocess.Popen(
+shlex.split(CC) +args,
+stdin=subprocess.PIPE,
+stdout=subprocess.PIPE,
+stderr=subprocess.PIPE
+ )
+withproc:
+proc.stdin.write(b'\n')
+out=to_utf8(proc.communicate()[0])
+
+ifproc.returncode!=0:
+warn('Failed to extract OpenSSL macros from headers')
+return {}
+
+macros= {}
+forlineinout.split('\n'):
+ifline.startswith('#define OPENSSL_'):
+parts=line.split()
+iflen(parts) >=2:
+macro_name=parts[1]
+macro_value=parts[2] iflen(parts) >=3else'1'
+macros[macro_name] =macro_value
+
+returnmacros
+
+defget_openssl_version(o):
 """Parse OpenSSL version from opensslv.h header file.
 
  Returns the version as a number matching OPENSSL_VERSION_NUMBER format:
- 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre), L=0
+ 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre),
+ L denotes as a long type literal
  """
 
 try:
-# Use the C compiler to extract preprocessor macros from opensslv.h
-args= ['-E', '-dM', '-include', 'openssl/opensslv.h', '-']
-ifnotoptions.shared_openssl:
-args= ['-I', 'deps/openssl/openssl/include'] +args
-elifoptions.shared_openssl_includes:
-args= ['-I', options.shared_openssl_includes] +args
-
-proc=subprocess.Popen(
-shlex.split(CC) +args,
-stdin=subprocess.PIPE,
-stdout=subprocess.PIPE,
-stderr=subprocess.PIPE
- )
-withproc:
-proc.stdin.write(b'\n')
-out=to_utf8(proc.communicate()[0])
-
-ifproc.returncode!=0:
-warn('Failed to extract OpenSSL version from opensslv.h header')
-return0
-
-# Parse the macro definitions
-macros= {}
-forlineinout.split('\n'):
-ifline.startswith('#define OPENSSL_VERSION_'):
-parts=line.split()
-iflen(parts) >=3:
-macro_name=parts[1]
-macro_value=parts[2]
-macros[macro_name] =macro_value
+macros=get_openssl_macros(o)
 
 # Extract version components
 major=int(macros.get('OPENSSL_VERSION_MAJOR', '0'))
 minor=int(macros.get('OPENSSL_VERSION_MINOR', '0'))
 patch=int(macros.get('OPENSSL_VERSION_PATCH', '0'))
 
+# If major, minor and patch are all 0, this is probably OpenSSL < 3.
+if (major, minor, patch) == (0, 0, 0):
+version_number=macros.get('OPENSSL_VERSION_NUMBER')
+# Prior to OpenSSL 3 the value should be in the format 0xMNN00PPSL.
+# If it is, we need to strip the `L` suffix prior to parsing.
+ifversion_number[:2] =="0x"andversion_number[-1] =="L":
+returnint(version_number[:-1], 16)
+
 # Check if it's a pre-release (has non-empty PRE_RELEASE string)
 pre_release=macros.get('OPENSSL_VERSION_PRE_RELEASE', '""').strip('"')
 status=0x0ifpre_releaseelse0xf
@@ -1387,6 +1409,13 @@ def get_openssl_version():
 warn(f'Failed to determine OpenSSL version from header: {e}')
 return0
 
+defget_openssl_is_boringssl(o):
+try:
+returnb('OPENSSL_IS_BORINGSSL'inget_openssl_macros(o))
+except (OSError, ValueError, subprocess.SubprocessError) ase:
+warn(f'Failed to determine whether OpenSSL headers are BoringSSL: {e}')
+return'false'
+
 # Note: Apple clang self-reports as clang 4.2.0 and gcc 4.2.1. It passes
 # the version check more by accident than anything else but a more rigorous
 # check involves checking the build number against an allowlist. I'm not
@@ -2065,7 +2094,8 @@ def without_ssl_error(option):
 
 configure_library('openssl', o)
 
-o['variables']['openssl_version'] =get_openssl_version()
+o['variables']['openssl_version'] =get_openssl_version(o)
+o['variables']['openssl_is_boringssl'] =get_openssl_is_boringssl(o)
 
 defconfigure_sqlite(o):
 o['variables']['node_use_sqlite'] =b(notoptions.without_sqlite)

deps/ncrypto/engine.cc

@@ -1,12 +1,18 @@
 #include"ncrypto.h"
 
+#if !defined(OPENSSL_NO_ENGINE) && \
+ ((defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT) || \
+NCRYPTO_USE_LEGACY_OPENSSL)
+#include<openssl/engine.h>
+#endif
+
 namespacencrypto {
 
 // ============================================================================
 // Engine
 
 #ifndef OPENSSL_NO_ENGINE
-EnginePointer::EnginePointer(ENGINE* engine_, bool finish_on_exit_)
+EnginePointer::EnginePointer(void* engine_, bool finish_on_exit_)
  : engine(engine_), finish_on_exit(finish_on_exit_) {}
 
 EnginePointer::EnginePointer(EnginePointer&& other) noexcept
@@ -24,21 +30,22 @@ EnginePointer& EnginePointer::operator=(EnginePointer&& other) noexcept {
 return *new (this) EnginePointer(std::move(other));
 }
 
-voidEnginePointer::reset(ENGINE* engine_, bool finish_on_exit_) {
+voidEnginePointer::reset(void* engine_, bool finish_on_exit_) {
 if (engine != nullptr) {
+ENGINE* current = static_cast<ENGINE*>(engine);
 if (finish_on_exit) {
 // This also does the equivalent of ENGINE_free.
-ENGINE_finish(engine);
+ENGINE_finish(current);
  } else {
-ENGINE_free(engine);
+ENGINE_free(current);
  }
  }
  engine = engine_;
  finish_on_exit = finish_on_exit_;
 }
 
-ENGINE* EnginePointer::release() {
-ENGINE* ret = engine;
+void* EnginePointer::release() {
+void* ret = engine;
  engine = nullptr;
  finish_on_exit = false;
 return ret;
@@ -52,8 +59,9 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 // Engine not found, try loading dynamically.
  engine = EnginePointer(ENGINE_by_id("dynamic"));
 if (engine) {
-if (!ENGINE_ctrl_cmd_string(engine.get(), "SO_PATH", name, 0) ||
- !ENGINE_ctrl_cmd_string(engine.get(), "LOAD", nullptr, 0)) {
+ENGINE* current = static_cast<ENGINE*>(engine.engine);
+if (!ENGINE_ctrl_cmd_string(current, "SO_PATH", name, 0) ||
+ !ENGINE_ctrl_cmd_string(current, "LOAD", nullptr, 0)) {
  engine.reset();
  }
  }
@@ -64,19 +72,24 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 boolEnginePointer::setAsDefault(uint32_t flags, CryptoErrorList* errors) {
 if (engine == nullptr) returnfalse;
  ClearErrorOnReturn clear_error_on_return(errors);
-returnENGINE_set_default(engine, flags) != 0;
+returnENGINE_set_default(static_cast<ENGINE*>(engine), flags) != 0;
 }
 
 boolEnginePointer::init(bool finish_on_exit) {
 if (engine == nullptr) returnfalse;
 if (finish_on_exit) setFinishOnExit();
-returnENGINE_init(engine) == 1;
+returnENGINE_init(static_cast<ENGINE*>(engine)) == 1;
 }
 
 EVPKeyPointer EnginePointer::loadPrivateKey(constchar* key_name) {
 if (engine == nullptr) returnEVPKeyPointer();
-returnEVPKeyPointer(
-ENGINE_load_private_key(engine, key_name, nullptr, nullptr));
+returnEVPKeyPointer(ENGINE_load_private_key(
+static_cast<ENGINE*>(engine), key_name, nullptr, nullptr));
+}
+
+boolEnginePointer::setClientCertEngine(SSL_CTX* ctx) {
+if (engine == nullptr || ctx == nullptr) returnfalse;
+returnSSL_CTX_set_client_cert_engine(ctx, static_cast<ENGINE*>(engine)) == 1;
 }
 
 voidEnginePointer::initEnginesOnce() {

common.gypi

@@ -24,6 +24,7 @@
 'node_module_version%': '',
 'node_with_ltcg%': '',
 'node_shared_openssl%': 'false',
+'openssl_is_boringssl%': 'false',
 
 'node_tag%': '',
 'uv_library%': 'static_library',

configure.py

@@ -1328,50 +1328,72 @@ def get_gas_version(cc):
 warn(f'Could not recognize `gas`: {gas_ret}')
 return'0.0'
 
-defget_openssl_version():
+defget_openssl_macros(o):
+"""Extract OpenSSL preprocessor macros from the configured headers."""
+
+# Use the C compiler to extract preprocessor macros from OpenSSL headers.
+# crypto.h is included because BoringSSL declares OPENSSL_IS_BORINGSSL there.
+args= ['-E', '-dM',
+'-include', 'openssl/opensslv.h',
+'-include', 'openssl/crypto.h',
+'-']
+ifnotoptions.shared_openssl:
+args= ['-I', 'deps/openssl/openssl/include'] +args
+elifoptions.shared_openssl_includes:
+args= ['-I', options.shared_openssl_includes] +args
+else:
+fordirino['include_dirs']:
+args= ['-I', dir] +args
+
+proc=subprocess.Popen(
+shlex.split(CC) +args,
+stdin=subprocess.PIPE,
+stdout=subprocess.PIPE,
+stderr=subprocess.PIPE
+ )
+withproc:
+proc.stdin.write(b'\n')
+out=to_utf8(proc.communicate()[0])
+
+ifproc.returncode!=0:
+warn('Failed to extract OpenSSL macros from headers')
+return {}
+
+macros= {}
+forlineinout.split('\n'):
+ifline.startswith('#define OPENSSL_'):
+parts=line.split()
+iflen(parts) >=2:
+macro_name=parts[1]
+macro_value=parts[2] iflen(parts) >=3else'1'
+macros[macro_name] =macro_value
+
+returnmacros
+
+defget_openssl_version(o):
 """Parse OpenSSL version from opensslv.h header file.
 
  Returns the version as a number matching OPENSSL_VERSION_NUMBER format:
- 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre), L=0
+ 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre),
+ L denotes as a long type literal
  """
 
 try:
-# Use the C compiler to extract preprocessor macros from opensslv.h
-args= ['-E', '-dM', '-include', 'openssl/opensslv.h', '-']
-ifnotoptions.shared_openssl:
-args= ['-I', 'deps/openssl/openssl/include'] +args
-elifoptions.shared_openssl_includes:
-args= ['-I', options.shared_openssl_includes] +args
-
-proc=subprocess.Popen(
-shlex.split(CC) +args,
-stdin=subprocess.PIPE,
-stdout=subprocess.PIPE,
-stderr=subprocess.PIPE
- )
-withproc:
-proc.stdin.write(b'\n')
-out=to_utf8(proc.communicate()[0])
-
-ifproc.returncode!=0:
-warn('Failed to extract OpenSSL version from opensslv.h header')
-return0
-
-# Parse the macro definitions
-macros= {}
-forlineinout.split('\n'):
-ifline.startswith('#define OPENSSL_VERSION_'):
-parts=line.split()
-iflen(parts) >=3:
-macro_name=parts[1]
-macro_value=parts[2]
-macros[macro_name] =macro_value
+macros=get_openssl_macros(o)
 
 # Extract version components
 major=int(macros.get('OPENSSL_VERSION_MAJOR', '0'))
 minor=int(macros.get('OPENSSL_VERSION_MINOR', '0'))
 patch=int(macros.get('OPENSSL_VERSION_PATCH', '0'))
 
+# If major, minor and patch are all 0, this is probably OpenSSL < 3.
+if (major, minor, patch) == (0, 0, 0):
+version_number=macros.get('OPENSSL_VERSION_NUMBER')
+# Prior to OpenSSL 3 the value should be in the format 0xMNN00PPSL.
+# If it is, we need to strip the `L` suffix prior to parsing.
+ifversion_number[:2] =="0x"andversion_number[-1] =="L":
+returnint(version_number[:-1], 16)
+
 # Check if it's a pre-release (has non-empty PRE_RELEASE string)
 pre_release=macros.get('OPENSSL_VERSION_PRE_RELEASE', '""').strip('"')
 status=0x0ifpre_releaseelse0xf
@@ -1387,6 +1409,13 @@ def get_openssl_version():
 warn(f'Failed to determine OpenSSL version from header: {e}')
 return0
 
+defget_openssl_is_boringssl(o):
+try:
+returnb('OPENSSL_IS_BORINGSSL'inget_openssl_macros(o))
+except (OSError, ValueError, subprocess.SubprocessError) ase:
+warn(f'Failed to determine whether OpenSSL headers are BoringSSL: {e}')
+return'false'
+
 # Note: Apple clang self-reports as clang 4.2.0 and gcc 4.2.1. It passes
 # the version check more by accident than anything else but a more rigorous
 # check involves checking the build number against an allowlist. I'm not
@@ -2065,7 +2094,8 @@ def without_ssl_error(option):
 
 configure_library('openssl', o)
 
-o['variables']['openssl_version'] =get_openssl_version()
+o['variables']['openssl_version'] =get_openssl_version(o)
+o['variables']['openssl_is_boringssl'] =get_openssl_is_boringssl(o)
 
 defconfigure_sqlite(o):
 o['variables']['node_use_sqlite'] =b(notoptions.without_sqlite)

deps/ncrypto/engine.cc

@@ -1,12 +1,18 @@
 #include"ncrypto.h"
 
+#if !defined(OPENSSL_NO_ENGINE) && \
+ ((defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT) || \
+NCRYPTO_USE_LEGACY_OPENSSL)
+#include<openssl/engine.h>
+#endif
+
 namespacencrypto {
 
 // ============================================================================
 // Engine
 
 #ifndef OPENSSL_NO_ENGINE
-EnginePointer::EnginePointer(ENGINE* engine_, bool finish_on_exit_)
+EnginePointer::EnginePointer(void* engine_, bool finish_on_exit_)
  : engine(engine_), finish_on_exit(finish_on_exit_) {}
 
 EnginePointer::EnginePointer(EnginePointer&& other) noexcept
@@ -24,21 +30,22 @@ EnginePointer& EnginePointer::operator=(EnginePointer&& other) noexcept {
 return *new (this) EnginePointer(std::move(other));
 }
 
-voidEnginePointer::reset(ENGINE* engine_, bool finish_on_exit_) {
+voidEnginePointer::reset(void* engine_, bool finish_on_exit_) {
 if (engine != nullptr) {
+ENGINE* current = static_cast<ENGINE*>(engine);
 if (finish_on_exit) {
 // This also does the equivalent of ENGINE_free.
-ENGINE_finish(engine);
+ENGINE_finish(current);
  } else {
-ENGINE_free(engine);
+ENGINE_free(current);
  }
  }
  engine = engine_;
  finish_on_exit = finish_on_exit_;
 }
 
-ENGINE* EnginePointer::release() {
-ENGINE* ret = engine;
+void* EnginePointer::release() {
+void* ret = engine;
  engine = nullptr;
  finish_on_exit = false;
 return ret;
@@ -52,8 +59,9 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 // Engine not found, try loading dynamically.
  engine = EnginePointer(ENGINE_by_id("dynamic"));
 if (engine) {
-if (!ENGINE_ctrl_cmd_string(engine.get(), "SO_PATH", name, 0) ||
- !ENGINE_ctrl_cmd_string(engine.get(), "LOAD", nullptr, 0)) {
+ENGINE* current = static_cast<ENGINE*>(engine.engine);
+if (!ENGINE_ctrl_cmd_string(current, "SO_PATH", name, 0) ||
+ !ENGINE_ctrl_cmd_string(current, "LOAD", nullptr, 0)) {
  engine.reset();
  }
  }
@@ -64,19 +72,24 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 boolEnginePointer::setAsDefault(uint32_t flags, CryptoErrorList* errors) {
 if (engine == nullptr) returnfalse;
  ClearErrorOnReturn clear_error_on_return(errors);
-returnENGINE_set_default(engine, flags) != 0;
+returnENGINE_set_default(static_cast<ENGINE*>(engine), flags) != 0;
 }
 
 boolEnginePointer::init(bool finish_on_exit) {
 if (engine == nullptr) returnfalse;
 if (finish_on_exit) setFinishOnExit();
-returnENGINE_init(engine) == 1;
+returnENGINE_init(static_cast<ENGINE*>(engine)) == 1;
 }
 
 EVPKeyPointer EnginePointer::loadPrivateKey(constchar* key_name) {
 if (engine == nullptr) returnEVPKeyPointer();
-returnEVPKeyPointer(
-ENGINE_load_private_key(engine, key_name, nullptr, nullptr));
+returnEVPKeyPointer(ENGINE_load_private_key(
+static_cast<ENGINE*>(engine), key_name, nullptr, nullptr));
+}
+
+boolEnginePointer::setClientCertEngine(SSL_CTX* ctx) {
+if (engine == nullptr || ctx == nullptr) returnfalse;
+returnSSL_CTX_set_client_cert_engine(ctx, static_cast<ENGINE*>(engine)) == 1;
 }
 
 voidEnginePointer::initEnginesOnce() {

common.gypi

@@ -24,6 +24,7 @@
 'node_module_version%': '',
 'node_with_ltcg%': '',
 'node_shared_openssl%': 'false',
+'openssl_is_boringssl%': 'false',
 
 'node_tag%': '',
 'uv_library%': 'static_library',

configure.py

@@ -1328,50 +1328,72 @@ def get_gas_version(cc):
 warn(f'Could not recognize `gas`: {gas_ret}')
 return'0.0'
 
-defget_openssl_version():
+defget_openssl_macros(o):
+"""Extract OpenSSL preprocessor macros from the configured headers."""
+
+# Use the C compiler to extract preprocessor macros from OpenSSL headers.
+# crypto.h is included because BoringSSL declares OPENSSL_IS_BORINGSSL there.
+args= ['-E', '-dM',
+'-include', 'openssl/opensslv.h',
+'-include', 'openssl/crypto.h',
+'-']
+ifnotoptions.shared_openssl:
+args= ['-I', 'deps/openssl/openssl/include'] +args
+elifoptions.shared_openssl_includes:
+args= ['-I', options.shared_openssl_includes] +args
+else:
+fordirino['include_dirs']:
+args= ['-I', dir] +args
+
+proc=subprocess.Popen(
+shlex.split(CC) +args,
+stdin=subprocess.PIPE,
+stdout=subprocess.PIPE,
+stderr=subprocess.PIPE
+ )
+withproc:
+proc.stdin.write(b'\n')
+out=to_utf8(proc.communicate()[0])
+
+ifproc.returncode!=0:
+warn('Failed to extract OpenSSL macros from headers')
+return {}
+
+macros= {}
+forlineinout.split('\n'):
+ifline.startswith('#define OPENSSL_'):
+parts=line.split()
+iflen(parts) >=2:
+macro_name=parts[1]
+macro_value=parts[2] iflen(parts) >=3else'1'
+macros[macro_name] =macro_value
+
+returnmacros
+
+defget_openssl_version(o):
 """Parse OpenSSL version from opensslv.h header file.
 
  Returns the version as a number matching OPENSSL_VERSION_NUMBER format:
- 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre), L=0
+ 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre),
+ L denotes as a long type literal
  """
 
 try:
-# Use the C compiler to extract preprocessor macros from opensslv.h
-args= ['-E', '-dM', '-include', 'openssl/opensslv.h', '-']
-ifnotoptions.shared_openssl:
-args= ['-I', 'deps/openssl/openssl/include'] +args
-elifoptions.shared_openssl_includes:
-args= ['-I', options.shared_openssl_includes] +args
-
-proc=subprocess.Popen(
-shlex.split(CC) +args,
-stdin=subprocess.PIPE,
-stdout=subprocess.PIPE,
-stderr=subprocess.PIPE
- )
-withproc:
-proc.stdin.write(b'\n')
-out=to_utf8(proc.communicate()[0])
-
-ifproc.returncode!=0:
-warn('Failed to extract OpenSSL version from opensslv.h header')
-return0
-
-# Parse the macro definitions
-macros= {}
-forlineinout.split('\n'):
-ifline.startswith('#define OPENSSL_VERSION_'):
-parts=line.split()
-iflen(parts) >=3:
-macro_name=parts[1]
-macro_value=parts[2]
-macros[macro_name] =macro_value
+macros=get_openssl_macros(o)
 
 # Extract version components
 major=int(macros.get('OPENSSL_VERSION_MAJOR', '0'))
 minor=int(macros.get('OPENSSL_VERSION_MINOR', '0'))
 patch=int(macros.get('OPENSSL_VERSION_PATCH', '0'))
 
+# If major, minor and patch are all 0, this is probably OpenSSL < 3.
+if (major, minor, patch) == (0, 0, 0):
+version_number=macros.get('OPENSSL_VERSION_NUMBER')
+# Prior to OpenSSL 3 the value should be in the format 0xMNN00PPSL.
+# If it is, we need to strip the `L` suffix prior to parsing.
+ifversion_number[:2] =="0x"andversion_number[-1] =="L":
+returnint(version_number[:-1], 16)
+
 # Check if it's a pre-release (has non-empty PRE_RELEASE string)
 pre_release=macros.get('OPENSSL_VERSION_PRE_RELEASE', '""').strip('"')
 status=0x0ifpre_releaseelse0xf
@@ -1387,6 +1409,13 @@ def get_openssl_version():
 warn(f'Failed to determine OpenSSL version from header: {e}')
 return0
 
+defget_openssl_is_boringssl(o):
+try:
+returnb('OPENSSL_IS_BORINGSSL'inget_openssl_macros(o))
+except (OSError, ValueError, subprocess.SubprocessError) ase:
+warn(f'Failed to determine whether OpenSSL headers are BoringSSL: {e}')
+return'false'
+
 # Note: Apple clang self-reports as clang 4.2.0 and gcc 4.2.1. It passes
 # the version check more by accident than anything else but a more rigorous
 # check involves checking the build number against an allowlist. I'm not
@@ -2065,7 +2094,8 @@ def without_ssl_error(option):
 
 configure_library('openssl', o)
 
-o['variables']['openssl_version'] =get_openssl_version()
+o['variables']['openssl_version'] =get_openssl_version(o)
+o['variables']['openssl_is_boringssl'] =get_openssl_is_boringssl(o)
 
 defconfigure_sqlite(o):
 o['variables']['node_use_sqlite'] =b(notoptions.without_sqlite)

deps/ncrypto/engine.cc

@@ -1,12 +1,18 @@
 #include"ncrypto.h"
 
+#if !defined(OPENSSL_NO_ENGINE) && \
+ ((defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT) || \
+NCRYPTO_USE_LEGACY_OPENSSL)
+#include<openssl/engine.h>
+#endif
+
 namespacencrypto {
 
 // ============================================================================
 // Engine
 
 #ifndef OPENSSL_NO_ENGINE
-EnginePointer::EnginePointer(ENGINE* engine_, bool finish_on_exit_)
+EnginePointer::EnginePointer(void* engine_, bool finish_on_exit_)
  : engine(engine_), finish_on_exit(finish_on_exit_) {}
 
 EnginePointer::EnginePointer(EnginePointer&& other) noexcept
@@ -24,21 +30,22 @@ EnginePointer& EnginePointer::operator=(EnginePointer&& other) noexcept {
 return *new (this) EnginePointer(std::move(other));
 }
 
-voidEnginePointer::reset(ENGINE* engine_, bool finish_on_exit_) {
+voidEnginePointer::reset(void* engine_, bool finish_on_exit_) {
 if (engine != nullptr) {
+ENGINE* current = static_cast<ENGINE*>(engine);
 if (finish_on_exit) {
 // This also does the equivalent of ENGINE_free.
-ENGINE_finish(engine);
+ENGINE_finish(current);
  } else {
-ENGINE_free(engine);
+ENGINE_free(current);
  }
  }
  engine = engine_;
  finish_on_exit = finish_on_exit_;
 }
 
-ENGINE* EnginePointer::release() {
-ENGINE* ret = engine;
+void* EnginePointer::release() {
+void* ret = engine;
  engine = nullptr;
  finish_on_exit = false;
 return ret;
@@ -52,8 +59,9 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 // Engine not found, try loading dynamically.
  engine = EnginePointer(ENGINE_by_id("dynamic"));
 if (engine) {
-if (!ENGINE_ctrl_cmd_string(engine.get(), "SO_PATH", name, 0) ||
- !ENGINE_ctrl_cmd_string(engine.get(), "LOAD", nullptr, 0)) {
+ENGINE* current = static_cast<ENGINE*>(engine.engine);
+if (!ENGINE_ctrl_cmd_string(current, "SO_PATH", name, 0) ||
+ !ENGINE_ctrl_cmd_string(current, "LOAD", nullptr, 0)) {
  engine.reset();
  }
  }
@@ -64,19 +72,24 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 boolEnginePointer::setAsDefault(uint32_t flags, CryptoErrorList* errors) {
 if (engine == nullptr) returnfalse;
  ClearErrorOnReturn clear_error_on_return(errors);
-returnENGINE_set_default(engine, flags) != 0;
+returnENGINE_set_default(static_cast<ENGINE*>(engine), flags) != 0;
 }
 
 boolEnginePointer::init(bool finish_on_exit) {
 if (engine == nullptr) returnfalse;
 if (finish_on_exit) setFinishOnExit();
-returnENGINE_init(engine) == 1;
+returnENGINE_init(static_cast<ENGINE*>(engine)) == 1;
 }
 
 EVPKeyPointer EnginePointer::loadPrivateKey(constchar* key_name) {
 if (engine == nullptr) returnEVPKeyPointer();
-returnEVPKeyPointer(
-ENGINE_load_private_key(engine, key_name, nullptr, nullptr));
+returnEVPKeyPointer(ENGINE_load_private_key(
+static_cast<ENGINE*>(engine), key_name, nullptr, nullptr));
+}
+
+boolEnginePointer::setClientCertEngine(SSL_CTX* ctx) {
+if (engine == nullptr || ctx == nullptr) returnfalse;
+returnSSL_CTX_set_client_cert_engine(ctx, static_cast<ENGINE*>(engine)) == 1;
 }
 
 voidEnginePointer::initEnginesOnce() {

common.gypi

@@ -24,6 +24,7 @@
 'node_module_version%': '',
 'node_with_ltcg%': '',
 'node_shared_openssl%': 'false',
+'openssl_is_boringssl%': 'false',
 
 'node_tag%': '',
 'uv_library%': 'static_library',

configure.py

@@ -1328,50 +1328,72 @@ def get_gas_version(cc):
 warn(f'Could not recognize `gas`: {gas_ret}')
 return'0.0'
 
-defget_openssl_version():
+defget_openssl_macros(o):
+"""Extract OpenSSL preprocessor macros from the configured headers."""
+
+# Use the C compiler to extract preprocessor macros from OpenSSL headers.
+# crypto.h is included because BoringSSL declares OPENSSL_IS_BORINGSSL there.
+args= ['-E', '-dM',
+'-include', 'openssl/opensslv.h',
+'-include', 'openssl/crypto.h',
+'-']
+ifnotoptions.shared_openssl:
+args= ['-I', 'deps/openssl/openssl/include'] +args
+elifoptions.shared_openssl_includes:
+args= ['-I', options.shared_openssl_includes] +args
+else:
+fordirino['include_dirs']:
+args= ['-I', dir] +args
+
+proc=subprocess.Popen(
+shlex.split(CC) +args,
+stdin=subprocess.PIPE,
+stdout=subprocess.PIPE,
+stderr=subprocess.PIPE
+ )
+withproc:
+proc.stdin.write(b'\n')
+out=to_utf8(proc.communicate()[0])
+
+ifproc.returncode!=0:
+warn('Failed to extract OpenSSL macros from headers')
+return {}
+
+macros= {}
+forlineinout.split('\n'):
+ifline.startswith('#define OPENSSL_'):
+parts=line.split()
+iflen(parts) >=2:
+macro_name=parts[1]
+macro_value=parts[2] iflen(parts) >=3else'1'
+macros[macro_name] =macro_value
+
+returnmacros
+
+defget_openssl_version(o):
 """Parse OpenSSL version from opensslv.h header file.
 
  Returns the version as a number matching OPENSSL_VERSION_NUMBER format:
- 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre), L=0
+ 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre),
+ L denotes as a long type literal
  """
 
 try:
-# Use the C compiler to extract preprocessor macros from opensslv.h
-args= ['-E', '-dM', '-include', 'openssl/opensslv.h', '-']
-ifnotoptions.shared_openssl:
-args= ['-I', 'deps/openssl/openssl/include'] +args
-elifoptions.shared_openssl_includes:
-args= ['-I', options.shared_openssl_includes] +args
-
-proc=subprocess.Popen(
-shlex.split(CC) +args,
-stdin=subprocess.PIPE,
-stdout=subprocess.PIPE,
-stderr=subprocess.PIPE
- )
-withproc:
-proc.stdin.write(b'\n')
-out=to_utf8(proc.communicate()[0])
-
-ifproc.returncode!=0:
-warn('Failed to extract OpenSSL version from opensslv.h header')
-return0
-
-# Parse the macro definitions
-macros= {}
-forlineinout.split('\n'):
-ifline.startswith('#define OPENSSL_VERSION_'):
-parts=line.split()
-iflen(parts) >=3:
-macro_name=parts[1]
-macro_value=parts[2]
-macros[macro_name] =macro_value
+macros=get_openssl_macros(o)
 
 # Extract version components
 major=int(macros.get('OPENSSL_VERSION_MAJOR', '0'))
 minor=int(macros.get('OPENSSL_VERSION_MINOR', '0'))
 patch=int(macros.get('OPENSSL_VERSION_PATCH', '0'))
 
+# If major, minor and patch are all 0, this is probably OpenSSL < 3.
+if (major, minor, patch) == (0, 0, 0):
+version_number=macros.get('OPENSSL_VERSION_NUMBER')
+# Prior to OpenSSL 3 the value should be in the format 0xMNN00PPSL.
+# If it is, we need to strip the `L` suffix prior to parsing.
+ifversion_number[:2] =="0x"andversion_number[-1] =="L":
+returnint(version_number[:-1], 16)
+
 # Check if it's a pre-release (has non-empty PRE_RELEASE string)
 pre_release=macros.get('OPENSSL_VERSION_PRE_RELEASE', '""').strip('"')
 status=0x0ifpre_releaseelse0xf
@@ -1387,6 +1409,13 @@ def get_openssl_version():
 warn(f'Failed to determine OpenSSL version from header: {e}')
 return0
 
+defget_openssl_is_boringssl(o):
+try:
+returnb('OPENSSL_IS_BORINGSSL'inget_openssl_macros(o))
+except (OSError, ValueError, subprocess.SubprocessError) ase:
+warn(f'Failed to determine whether OpenSSL headers are BoringSSL: {e}')
+return'false'
+
 # Note: Apple clang self-reports as clang 4.2.0 and gcc 4.2.1. It passes
 # the version check more by accident than anything else but a more rigorous
 # check involves checking the build number against an allowlist. I'm not
@@ -2065,7 +2094,8 @@ def without_ssl_error(option):
 
 configure_library('openssl', o)
 
-o['variables']['openssl_version'] =get_openssl_version()
+o['variables']['openssl_version'] =get_openssl_version(o)
+o['variables']['openssl_is_boringssl'] =get_openssl_is_boringssl(o)
 
 defconfigure_sqlite(o):
 o['variables']['node_use_sqlite'] =b(notoptions.without_sqlite)

deps/ncrypto/engine.cc

@@ -1,12 +1,18 @@
 #include"ncrypto.h"
 
+#if !defined(OPENSSL_NO_ENGINE) && \
+ ((defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT) || \
+NCRYPTO_USE_LEGACY_OPENSSL)
+#include<openssl/engine.h>
+#endif
+
 namespacencrypto {
 
 // ============================================================================
 // Engine
 
 #ifndef OPENSSL_NO_ENGINE
-EnginePointer::EnginePointer(ENGINE* engine_, bool finish_on_exit_)
+EnginePointer::EnginePointer(void* engine_, bool finish_on_exit_)
  : engine(engine_), finish_on_exit(finish_on_exit_) {}
 
 EnginePointer::EnginePointer(EnginePointer&& other) noexcept
@@ -24,21 +30,22 @@ EnginePointer& EnginePointer::operator=(EnginePointer&& other) noexcept {
 return *new (this) EnginePointer(std::move(other));
 }
 
-voidEnginePointer::reset(ENGINE* engine_, bool finish_on_exit_) {
+voidEnginePointer::reset(void* engine_, bool finish_on_exit_) {
 if (engine != nullptr) {
+ENGINE* current = static_cast<ENGINE*>(engine);
 if (finish_on_exit) {
 // This also does the equivalent of ENGINE_free.
-ENGINE_finish(engine);
+ENGINE_finish(current);
  } else {
-ENGINE_free(engine);
+ENGINE_free(current);
  }
  }
  engine = engine_;
  finish_on_exit = finish_on_exit_;
 }
 
-ENGINE* EnginePointer::release() {
-ENGINE* ret = engine;
+void* EnginePointer::release() {
+void* ret = engine;
  engine = nullptr;
  finish_on_exit = false;
 return ret;
@@ -52,8 +59,9 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 // Engine not found, try loading dynamically.
  engine = EnginePointer(ENGINE_by_id("dynamic"));
 if (engine) {
-if (!ENGINE_ctrl_cmd_string(engine.get(), "SO_PATH", name, 0) ||
- !ENGINE_ctrl_cmd_string(engine.get(), "LOAD", nullptr, 0)) {
+ENGINE* current = static_cast<ENGINE*>(engine.engine);
+if (!ENGINE_ctrl_cmd_string(current, "SO_PATH", name, 0) ||
+ !ENGINE_ctrl_cmd_string(current, "LOAD", nullptr, 0)) {
  engine.reset();
  }
  }
@@ -64,19 +72,24 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 boolEnginePointer::setAsDefault(uint32_t flags, CryptoErrorList* errors) {
 if (engine == nullptr) returnfalse;
  ClearErrorOnReturn clear_error_on_return(errors);
-returnENGINE_set_default(engine, flags) != 0;
+returnENGINE_set_default(static_cast<ENGINE*>(engine), flags) != 0;
 }
 
 boolEnginePointer::init(bool finish_on_exit) {
 if (engine == nullptr) returnfalse;
 if (finish_on_exit) setFinishOnExit();
-returnENGINE_init(engine) == 1;
+returnENGINE_init(static_cast<ENGINE*>(engine)) == 1;
 }
 
 EVPKeyPointer EnginePointer::loadPrivateKey(constchar* key_name) {
 if (engine == nullptr) returnEVPKeyPointer();
-returnEVPKeyPointer(
-ENGINE_load_private_key(engine, key_name, nullptr, nullptr));
+returnEVPKeyPointer(ENGINE_load_private_key(
+static_cast<ENGINE*>(engine), key_name, nullptr, nullptr));
+}
+
+boolEnginePointer::setClientCertEngine(SSL_CTX* ctx) {
+if (engine == nullptr || ctx == nullptr) returnfalse;
+returnSSL_CTX_set_client_cert_engine(ctx, static_cast<ENGINE*>(engine)) == 1;
 }
 
 voidEnginePointer::initEnginesOnce() {

common.gypi

@@ -24,6 +24,7 @@
 'node_module_version%': '',
 'node_with_ltcg%': '',
 'node_shared_openssl%': 'false',
+'openssl_is_boringssl%': 'false',
 
 'node_tag%': '',
 'uv_library%': 'static_library',

configure.py

@@ -1328,50 +1328,72 @@ def get_gas_version(cc):
 warn(f'Could not recognize `gas`: {gas_ret}')
 return'0.0'
 
-defget_openssl_version():
+defget_openssl_macros(o):
+"""Extract OpenSSL preprocessor macros from the configured headers."""
+
+# Use the C compiler to extract preprocessor macros from OpenSSL headers.
+# crypto.h is included because BoringSSL declares OPENSSL_IS_BORINGSSL there.
+args= ['-E', '-dM',
+'-include', 'openssl/opensslv.h',
+'-include', 'openssl/crypto.h',
+'-']
+ifnotoptions.shared_openssl:
+args= ['-I', 'deps/openssl/openssl/include'] +args
+elifoptions.shared_openssl_includes:
+args= ['-I', options.shared_openssl_includes] +args
+else:
+fordirino['include_dirs']:
+args= ['-I', dir] +args
+
+proc=subprocess.Popen(
+shlex.split(CC) +args,
+stdin=subprocess.PIPE,
+stdout=subprocess.PIPE,
+stderr=subprocess.PIPE
+ )
+withproc:
+proc.stdin.write(b'\n')
+out=to_utf8(proc.communicate()[0])
+
+ifproc.returncode!=0:
+warn('Failed to extract OpenSSL macros from headers')
+return {}
+
+macros= {}
+forlineinout.split('\n'):
+ifline.startswith('#define OPENSSL_'):
+parts=line.split()
+iflen(parts) >=2:
+macro_name=parts[1]
+macro_value=parts[2] iflen(parts) >=3else'1'
+macros[macro_name] =macro_value
+
+returnmacros
+
+defget_openssl_version(o):
 """Parse OpenSSL version from opensslv.h header file.
 
  Returns the version as a number matching OPENSSL_VERSION_NUMBER format:
- 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre), L=0
+ 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre),
+ L denotes as a long type literal
  """
 
 try:
-# Use the C compiler to extract preprocessor macros from opensslv.h
-args= ['-E', '-dM', '-include', 'openssl/opensslv.h', '-']
-ifnotoptions.shared_openssl:
-args= ['-I', 'deps/openssl/openssl/include'] +args
-elifoptions.shared_openssl_includes:
-args= ['-I', options.shared_openssl_includes] +args
-
-proc=subprocess.Popen(
-shlex.split(CC) +args,
-stdin=subprocess.PIPE,
-stdout=subprocess.PIPE,
-stderr=subprocess.PIPE
- )
-withproc:
-proc.stdin.write(b'\n')
-out=to_utf8(proc.communicate()[0])
-
-ifproc.returncode!=0:
-warn('Failed to extract OpenSSL version from opensslv.h header')
-return0
-
-# Parse the macro definitions
-macros= {}
-forlineinout.split('\n'):
-ifline.startswith('#define OPENSSL_VERSION_'):
-parts=line.split()
-iflen(parts) >=3:
-macro_name=parts[1]
-macro_value=parts[2]
-macros[macro_name] =macro_value
+macros=get_openssl_macros(o)
 
 # Extract version components
 major=int(macros.get('OPENSSL_VERSION_MAJOR', '0'))
 minor=int(macros.get('OPENSSL_VERSION_MINOR', '0'))
 patch=int(macros.get('OPENSSL_VERSION_PATCH', '0'))
 
+# If major, minor and patch are all 0, this is probably OpenSSL < 3.
+if (major, minor, patch) == (0, 0, 0):
+version_number=macros.get('OPENSSL_VERSION_NUMBER')
+# Prior to OpenSSL 3 the value should be in the format 0xMNN00PPSL.
+# If it is, we need to strip the `L` suffix prior to parsing.
+ifversion_number[:2] =="0x"andversion_number[-1] =="L":
+returnint(version_number[:-1], 16)
+
 # Check if it's a pre-release (has non-empty PRE_RELEASE string)
 pre_release=macros.get('OPENSSL_VERSION_PRE_RELEASE', '""').strip('"')
 status=0x0ifpre_releaseelse0xf
@@ -1387,6 +1409,13 @@ def get_openssl_version():
 warn(f'Failed to determine OpenSSL version from header: {e}')
 return0
 
+defget_openssl_is_boringssl(o):
+try:
+returnb('OPENSSL_IS_BORINGSSL'inget_openssl_macros(o))
+except (OSError, ValueError, subprocess.SubprocessError) ase:
+warn(f'Failed to determine whether OpenSSL headers are BoringSSL: {e}')
+return'false'
+
 # Note: Apple clang self-reports as clang 4.2.0 and gcc 4.2.1. It passes
 # the version check more by accident than anything else but a more rigorous
 # check involves checking the build number against an allowlist. I'm not
@@ -2065,7 +2094,8 @@ def without_ssl_error(option):
 
 configure_library('openssl', o)
 
-o['variables']['openssl_version'] =get_openssl_version()
+o['variables']['openssl_version'] =get_openssl_version(o)
+o['variables']['openssl_is_boringssl'] =get_openssl_is_boringssl(o)
 
 defconfigure_sqlite(o):
 o['variables']['node_use_sqlite'] =b(notoptions.without_sqlite)

deps/ncrypto/engine.cc

@@ -1,12 +1,18 @@
 #include"ncrypto.h"
 
+#if !defined(OPENSSL_NO_ENGINE) && \
+ ((defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT) || \
+NCRYPTO_USE_LEGACY_OPENSSL)
+#include<openssl/engine.h>
+#endif
+
 namespacencrypto {
 
 // ============================================================================
 // Engine
 
 #ifndef OPENSSL_NO_ENGINE
-EnginePointer::EnginePointer(ENGINE* engine_, bool finish_on_exit_)
+EnginePointer::EnginePointer(void* engine_, bool finish_on_exit_)
  : engine(engine_), finish_on_exit(finish_on_exit_) {}
 
 EnginePointer::EnginePointer(EnginePointer&& other) noexcept
@@ -24,21 +30,22 @@ EnginePointer& EnginePointer::operator=(EnginePointer&& other) noexcept {
 return *new (this) EnginePointer(std::move(other));
 }
 
-voidEnginePointer::reset(ENGINE* engine_, bool finish_on_exit_) {
+voidEnginePointer::reset(void* engine_, bool finish_on_exit_) {
 if (engine != nullptr) {
+ENGINE* current = static_cast<ENGINE*>(engine);
 if (finish_on_exit) {
 // This also does the equivalent of ENGINE_free.
-ENGINE_finish(engine);
+ENGINE_finish(current);
  } else {
-ENGINE_free(engine);
+ENGINE_free(current);
  }
  }
  engine = engine_;
  finish_on_exit = finish_on_exit_;
 }
 
-ENGINE* EnginePointer::release() {
-ENGINE* ret = engine;
+void* EnginePointer::release() {
+void* ret = engine;
  engine = nullptr;
  finish_on_exit = false;
 return ret;
@@ -52,8 +59,9 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 // Engine not found, try loading dynamically.
  engine = EnginePointer(ENGINE_by_id("dynamic"));
 if (engine) {
-if (!ENGINE_ctrl_cmd_string(engine.get(), "SO_PATH", name, 0) ||
- !ENGINE_ctrl_cmd_string(engine.get(), "LOAD", nullptr, 0)) {
+ENGINE* current = static_cast<ENGINE*>(engine.engine);
+if (!ENGINE_ctrl_cmd_string(current, "SO_PATH", name, 0) ||
+ !ENGINE_ctrl_cmd_string(current, "LOAD", nullptr, 0)) {
  engine.reset();
  }
  }
@@ -64,19 +72,24 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 boolEnginePointer::setAsDefault(uint32_t flags, CryptoErrorList* errors) {
 if (engine == nullptr) returnfalse;
  ClearErrorOnReturn clear_error_on_return(errors);
-returnENGINE_set_default(engine, flags) != 0;
+returnENGINE_set_default(static_cast<ENGINE*>(engine), flags) != 0;
 }
 
 boolEnginePointer::init(bool finish_on_exit) {
 if (engine == nullptr) returnfalse;
 if (finish_on_exit) setFinishOnExit();
-returnENGINE_init(engine) == 1;
+returnENGINE_init(static_cast<ENGINE*>(engine)) == 1;
 }
 
 EVPKeyPointer EnginePointer::loadPrivateKey(constchar* key_name) {
 if (engine == nullptr) returnEVPKeyPointer();
-returnEVPKeyPointer(
-ENGINE_load_private_key(engine, key_name, nullptr, nullptr));
+returnEVPKeyPointer(ENGINE_load_private_key(
+static_cast<ENGINE*>(engine), key_name, nullptr, nullptr));
+}
+
+boolEnginePointer::setClientCertEngine(SSL_CTX* ctx) {
+if (engine == nullptr || ctx == nullptr) returnfalse;
+returnSSL_CTX_set_client_cert_engine(ctx, static_cast<ENGINE*>(engine)) == 1;
 }
 
 voidEnginePointer::initEnginesOnce() {

common.gypi

@@ -24,6 +24,7 @@
 'node_module_version%': '',
 'node_with_ltcg%': '',
 'node_shared_openssl%': 'false',
+'openssl_is_boringssl%': 'false',
 
 'node_tag%': '',
 'uv_library%': 'static_library',

configure.py

@@ -1328,50 +1328,72 @@ def get_gas_version(cc):
 warn(f'Could not recognize `gas`: {gas_ret}')
 return'0.0'
 
-defget_openssl_version():
+defget_openssl_macros(o):
+"""Extract OpenSSL preprocessor macros from the configured headers."""
+
+# Use the C compiler to extract preprocessor macros from OpenSSL headers.
+# crypto.h is included because BoringSSL declares OPENSSL_IS_BORINGSSL there.
+args= ['-E', '-dM',
+'-include', 'openssl/opensslv.h',
+'-include', 'openssl/crypto.h',
+'-']
+ifnotoptions.shared_openssl:
+args= ['-I', 'deps/openssl/openssl/include'] +args
+elifoptions.shared_openssl_includes:
+args= ['-I', options.shared_openssl_includes] +args
+else:
+fordirino['include_dirs']:
+args= ['-I', dir] +args
+
+proc=subprocess.Popen(
+shlex.split(CC) +args,
+stdin=subprocess.PIPE,
+stdout=subprocess.PIPE,
+stderr=subprocess.PIPE
+ )
+withproc:
+proc.stdin.write(b'\n')
+out=to_utf8(proc.communicate()[0])
+
+ifproc.returncode!=0:
+warn('Failed to extract OpenSSL macros from headers')
+return {}
+
+macros= {}
+forlineinout.split('\n'):
+ifline.startswith('#define OPENSSL_'):
+parts=line.split()
+iflen(parts) >=2:
+macro_name=parts[1]
+macro_value=parts[2] iflen(parts) >=3else'1'
+macros[macro_name] =macro_value
+
+returnmacros
+
+defget_openssl_version(o):
 """Parse OpenSSL version from opensslv.h header file.
 
  Returns the version as a number matching OPENSSL_VERSION_NUMBER format:
- 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre), L=0
+ 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre),
+ L denotes as a long type literal
  """
 
 try:
-# Use the C compiler to extract preprocessor macros from opensslv.h
-args= ['-E', '-dM', '-include', 'openssl/opensslv.h', '-']
-ifnotoptions.shared_openssl:
-args= ['-I', 'deps/openssl/openssl/include'] +args
-elifoptions.shared_openssl_includes:
-args= ['-I', options.shared_openssl_includes] +args
-
-proc=subprocess.Popen(
-shlex.split(CC) +args,
-stdin=subprocess.PIPE,
-stdout=subprocess.PIPE,
-stderr=subprocess.PIPE
- )
-withproc:
-proc.stdin.write(b'\n')
-out=to_utf8(proc.communicate()[0])
-
-ifproc.returncode!=0:
-warn('Failed to extract OpenSSL version from opensslv.h header')
-return0
-
-# Parse the macro definitions
-macros= {}
-forlineinout.split('\n'):
-ifline.startswith('#define OPENSSL_VERSION_'):
-parts=line.split()
-iflen(parts) >=3:
-macro_name=parts[1]
-macro_value=parts[2]
-macros[macro_name] =macro_value
+macros=get_openssl_macros(o)
 
 # Extract version components
 major=int(macros.get('OPENSSL_VERSION_MAJOR', '0'))
 minor=int(macros.get('OPENSSL_VERSION_MINOR', '0'))
 patch=int(macros.get('OPENSSL_VERSION_PATCH', '0'))
 
+# If major, minor and patch are all 0, this is probably OpenSSL < 3.
+if (major, minor, patch) == (0, 0, 0):
+version_number=macros.get('OPENSSL_VERSION_NUMBER')
+# Prior to OpenSSL 3 the value should be in the format 0xMNN00PPSL.
+# If it is, we need to strip the `L` suffix prior to parsing.
+ifversion_number[:2] =="0x"andversion_number[-1] =="L":
+returnint(version_number[:-1], 16)
+
 # Check if it's a pre-release (has non-empty PRE_RELEASE string)
 pre_release=macros.get('OPENSSL_VERSION_PRE_RELEASE', '""').strip('"')
 status=0x0ifpre_releaseelse0xf
@@ -1387,6 +1409,13 @@ def get_openssl_version():
 warn(f'Failed to determine OpenSSL version from header: {e}')
 return0
 
+defget_openssl_is_boringssl(o):
+try:
+returnb('OPENSSL_IS_BORINGSSL'inget_openssl_macros(o))
+except (OSError, ValueError, subprocess.SubprocessError) ase:
+warn(f'Failed to determine whether OpenSSL headers are BoringSSL: {e}')
+return'false'
+
 # Note: Apple clang self-reports as clang 4.2.0 and gcc 4.2.1. It passes
 # the version check more by accident than anything else but a more rigorous
 # check involves checking the build number against an allowlist. I'm not
@@ -2065,7 +2094,8 @@ def without_ssl_error(option):
 
 configure_library('openssl', o)
 
-o['variables']['openssl_version'] =get_openssl_version()
+o['variables']['openssl_version'] =get_openssl_version(o)
+o['variables']['openssl_is_boringssl'] =get_openssl_is_boringssl(o)
 
 defconfigure_sqlite(o):
 o['variables']['node_use_sqlite'] =b(notoptions.without_sqlite)

deps/ncrypto/engine.cc

@@ -1,12 +1,18 @@
 #include"ncrypto.h"
 
+#if !defined(OPENSSL_NO_ENGINE) && \
+ ((defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT) || \
+NCRYPTO_USE_LEGACY_OPENSSL)
+#include<openssl/engine.h>
+#endif
+
 namespacencrypto {
 
 // ============================================================================
 // Engine
 
 #ifndef OPENSSL_NO_ENGINE
-EnginePointer::EnginePointer(ENGINE* engine_, bool finish_on_exit_)
+EnginePointer::EnginePointer(void* engine_, bool finish_on_exit_)
  : engine(engine_), finish_on_exit(finish_on_exit_) {}
 
 EnginePointer::EnginePointer(EnginePointer&& other) noexcept
@@ -24,21 +30,22 @@ EnginePointer& EnginePointer::operator=(EnginePointer&& other) noexcept {
 return *new (this) EnginePointer(std::move(other));
 }
 
-voidEnginePointer::reset(ENGINE* engine_, bool finish_on_exit_) {
+voidEnginePointer::reset(void* engine_, bool finish_on_exit_) {
 if (engine != nullptr) {
+ENGINE* current = static_cast<ENGINE*>(engine);
 if (finish_on_exit) {
 // This also does the equivalent of ENGINE_free.
-ENGINE_finish(engine);
+ENGINE_finish(current);
  } else {
-ENGINE_free(engine);
+ENGINE_free(current);
  }
  }
  engine = engine_;
  finish_on_exit = finish_on_exit_;
 }
 
-ENGINE* EnginePointer::release() {
-ENGINE* ret = engine;
+void* EnginePointer::release() {
+void* ret = engine;
  engine = nullptr;
  finish_on_exit = false;
 return ret;
@@ -52,8 +59,9 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 // Engine not found, try loading dynamically.
  engine = EnginePointer(ENGINE_by_id("dynamic"));
 if (engine) {
-if (!ENGINE_ctrl_cmd_string(engine.get(), "SO_PATH", name, 0) ||
- !ENGINE_ctrl_cmd_string(engine.get(), "LOAD", nullptr, 0)) {
+ENGINE* current = static_cast<ENGINE*>(engine.engine);
+if (!ENGINE_ctrl_cmd_string(current, "SO_PATH", name, 0) ||
+ !ENGINE_ctrl_cmd_string(current, "LOAD", nullptr, 0)) {
  engine.reset();
  }
  }
@@ -64,19 +72,24 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 boolEnginePointer::setAsDefault(uint32_t flags, CryptoErrorList* errors) {
 if (engine == nullptr) returnfalse;
  ClearErrorOnReturn clear_error_on_return(errors);
-returnENGINE_set_default(engine, flags) != 0;
+returnENGINE_set_default(static_cast<ENGINE*>(engine), flags) != 0;
 }
 
 boolEnginePointer::init(bool finish_on_exit) {
 if (engine == nullptr) returnfalse;
 if (finish_on_exit) setFinishOnExit();
-returnENGINE_init(engine) == 1;
+returnENGINE_init(static_cast<ENGINE*>(engine)) == 1;
 }
 
 EVPKeyPointer EnginePointer::loadPrivateKey(constchar* key_name) {
 if (engine == nullptr) returnEVPKeyPointer();
-returnEVPKeyPointer(
-ENGINE_load_private_key(engine, key_name, nullptr, nullptr));
+returnEVPKeyPointer(ENGINE_load_private_key(
+static_cast<ENGINE*>(engine), key_name, nullptr, nullptr));
+}
+
+boolEnginePointer::setClientCertEngine(SSL_CTX* ctx) {
+if (engine == nullptr || ctx == nullptr) returnfalse;
+returnSSL_CTX_set_client_cert_engine(ctx, static_cast<ENGINE*>(engine)) == 1;
 }
 
 voidEnginePointer::initEnginesOnce() {

common.gypi

@@ -24,6 +24,7 @@
 'node_module_version%': '',
 'node_with_ltcg%': '',
 'node_shared_openssl%': 'false',
+'openssl_is_boringssl%': 'false',
 
 'node_tag%': '',
 'uv_library%': 'static_library',

configure.py

@@ -1328,50 +1328,72 @@ def get_gas_version(cc):
 warn(f'Could not recognize `gas`: {gas_ret}')
 return'0.0'
 
-defget_openssl_version():
+defget_openssl_macros(o):
+"""Extract OpenSSL preprocessor macros from the configured headers."""
+
+# Use the C compiler to extract preprocessor macros from OpenSSL headers.
+# crypto.h is included because BoringSSL declares OPENSSL_IS_BORINGSSL there.
+args= ['-E', '-dM',
+'-include', 'openssl/opensslv.h',
+'-include', 'openssl/crypto.h',
+'-']
+ifnotoptions.shared_openssl:
+args= ['-I', 'deps/openssl/openssl/include'] +args
+elifoptions.shared_openssl_includes:
+args= ['-I', options.shared_openssl_includes] +args
+else:
+fordirino['include_dirs']:
+args= ['-I', dir] +args
+
+proc=subprocess.Popen(
+shlex.split(CC) +args,
+stdin=subprocess.PIPE,
+stdout=subprocess.PIPE,
+stderr=subprocess.PIPE
+ )
+withproc:
+proc.stdin.write(b'\n')
+out=to_utf8(proc.communicate()[0])
+
+ifproc.returncode!=0:
+warn('Failed to extract OpenSSL macros from headers')
+return {}
+
+macros= {}
+forlineinout.split('\n'):
+ifline.startswith('#define OPENSSL_'):
+parts=line.split()
+iflen(parts) >=2:
+macro_name=parts[1]
+macro_value=parts[2] iflen(parts) >=3else'1'
+macros[macro_name] =macro_value
+
+returnmacros
+
+defget_openssl_version(o):
 """Parse OpenSSL version from opensslv.h header file.
 
  Returns the version as a number matching OPENSSL_VERSION_NUMBER format:
- 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre), L=0
+ 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre),
+ L denotes as a long type literal
  """
 
 try:
-# Use the C compiler to extract preprocessor macros from opensslv.h
-args= ['-E', '-dM', '-include', 'openssl/opensslv.h', '-']
-ifnotoptions.shared_openssl:
-args= ['-I', 'deps/openssl/openssl/include'] +args
-elifoptions.shared_openssl_includes:
-args= ['-I', options.shared_openssl_includes] +args
-
-proc=subprocess.Popen(
-shlex.split(CC) +args,
-stdin=subprocess.PIPE,
-stdout=subprocess.PIPE,
-stderr=subprocess.PIPE
- )
-withproc:
-proc.stdin.write(b'\n')
-out=to_utf8(proc.communicate()[0])
-
-ifproc.returncode!=0:
-warn('Failed to extract OpenSSL version from opensslv.h header')
-return0
-
-# Parse the macro definitions
-macros= {}
-forlineinout.split('\n'):
-ifline.startswith('#define OPENSSL_VERSION_'):
-parts=line.split()
-iflen(parts) >=3:
-macro_name=parts[1]
-macro_value=parts[2]
-macros[macro_name] =macro_value
+macros=get_openssl_macros(o)
 
 # Extract version components
 major=int(macros.get('OPENSSL_VERSION_MAJOR', '0'))
 minor=int(macros.get('OPENSSL_VERSION_MINOR', '0'))
 patch=int(macros.get('OPENSSL_VERSION_PATCH', '0'))
 
+# If major, minor and patch are all 0, this is probably OpenSSL < 3.
+if (major, minor, patch) == (0, 0, 0):
+version_number=macros.get('OPENSSL_VERSION_NUMBER')
+# Prior to OpenSSL 3 the value should be in the format 0xMNN00PPSL.
+# If it is, we need to strip the `L` suffix prior to parsing.
+ifversion_number[:2] =="0x"andversion_number[-1] =="L":
+returnint(version_number[:-1], 16)
+
 # Check if it's a pre-release (has non-empty PRE_RELEASE string)
 pre_release=macros.get('OPENSSL_VERSION_PRE_RELEASE', '""').strip('"')
 status=0x0ifpre_releaseelse0xf
@@ -1387,6 +1409,13 @@ def get_openssl_version():
 warn(f'Failed to determine OpenSSL version from header: {e}')
 return0
 
+defget_openssl_is_boringssl(o):
+try:
+returnb('OPENSSL_IS_BORINGSSL'inget_openssl_macros(o))
+except (OSError, ValueError, subprocess.SubprocessError) ase:
+warn(f'Failed to determine whether OpenSSL headers are BoringSSL: {e}')
+return'false'
+
 # Note: Apple clang self-reports as clang 4.2.0 and gcc 4.2.1. It passes
 # the version check more by accident than anything else but a more rigorous
 # check involves checking the build number against an allowlist. I'm not
@@ -2065,7 +2094,8 @@ def without_ssl_error(option):
 
 configure_library('openssl', o)
 
-o['variables']['openssl_version'] =get_openssl_version()
+o['variables']['openssl_version'] =get_openssl_version(o)
+o['variables']['openssl_is_boringssl'] =get_openssl_is_boringssl(o)
 
 defconfigure_sqlite(o):
 o['variables']['node_use_sqlite'] =b(notoptions.without_sqlite)

deps/ncrypto/engine.cc

@@ -1,12 +1,18 @@
 #include"ncrypto.h"
 
+#if !defined(OPENSSL_NO_ENGINE) && \
+ ((defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT) || \
+NCRYPTO_USE_LEGACY_OPENSSL)
+#include<openssl/engine.h>
+#endif
+
 namespacencrypto {
 
 // ============================================================================
 // Engine
 
 #ifndef OPENSSL_NO_ENGINE
-EnginePointer::EnginePointer(ENGINE* engine_, bool finish_on_exit_)
+EnginePointer::EnginePointer(void* engine_, bool finish_on_exit_)
  : engine(engine_), finish_on_exit(finish_on_exit_) {}
 
 EnginePointer::EnginePointer(EnginePointer&& other) noexcept
@@ -24,21 +30,22 @@ EnginePointer& EnginePointer::operator=(EnginePointer&& other) noexcept {
 return *new (this) EnginePointer(std::move(other));
 }
 
-voidEnginePointer::reset(ENGINE* engine_, bool finish_on_exit_) {
+voidEnginePointer::reset(void* engine_, bool finish_on_exit_) {
 if (engine != nullptr) {
+ENGINE* current = static_cast<ENGINE*>(engine);
 if (finish_on_exit) {
 // This also does the equivalent of ENGINE_free.
-ENGINE_finish(engine);
+ENGINE_finish(current);
  } else {
-ENGINE_free(engine);
+ENGINE_free(current);
  }
  }
  engine = engine_;
  finish_on_exit = finish_on_exit_;
 }
 
-ENGINE* EnginePointer::release() {
-ENGINE* ret = engine;
+void* EnginePointer::release() {
+void* ret = engine;
  engine = nullptr;
  finish_on_exit = false;
 return ret;
@@ -52,8 +59,9 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 // Engine not found, try loading dynamically.
  engine = EnginePointer(ENGINE_by_id("dynamic"));
 if (engine) {
-if (!ENGINE_ctrl_cmd_string(engine.get(), "SO_PATH", name, 0) ||
- !ENGINE_ctrl_cmd_string(engine.get(), "LOAD", nullptr, 0)) {
+ENGINE* current = static_cast<ENGINE*>(engine.engine);
+if (!ENGINE_ctrl_cmd_string(current, "SO_PATH", name, 0) ||
+ !ENGINE_ctrl_cmd_string(current, "LOAD", nullptr, 0)) {
  engine.reset();
  }
  }
@@ -64,19 +72,24 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 boolEnginePointer::setAsDefault(uint32_t flags, CryptoErrorList* errors) {
 if (engine == nullptr) returnfalse;
  ClearErrorOnReturn clear_error_on_return(errors);
-returnENGINE_set_default(engine, flags) != 0;
+returnENGINE_set_default(static_cast<ENGINE*>(engine), flags) != 0;
 }
 
 boolEnginePointer::init(bool finish_on_exit) {
 if (engine == nullptr) returnfalse;
 if (finish_on_exit) setFinishOnExit();
-returnENGINE_init(engine) == 1;
+returnENGINE_init(static_cast<ENGINE*>(engine)) == 1;
 }
 
 EVPKeyPointer EnginePointer::loadPrivateKey(constchar* key_name) {
 if (engine == nullptr) returnEVPKeyPointer();
-returnEVPKeyPointer(
-ENGINE_load_private_key(engine, key_name, nullptr, nullptr));
+returnEVPKeyPointer(ENGINE_load_private_key(
+static_cast<ENGINE*>(engine), key_name, nullptr, nullptr));
+}
+
+boolEnginePointer::setClientCertEngine(SSL_CTX* ctx) {
+if (engine == nullptr || ctx == nullptr) returnfalse;
+returnSSL_CTX_set_client_cert_engine(ctx, static_cast<ENGINE*>(engine)) == 1;
 }
 
 voidEnginePointer::initEnginesOnce() {

common.gypi

@@ -24,6 +24,7 @@
 'node_module_version%': '',
 'node_with_ltcg%': '',
 'node_shared_openssl%': 'false',
+'openssl_is_boringssl%': 'false',
 
 'node_tag%': '',
 'uv_library%': 'static_library',

configure.py

@@ -1328,50 +1328,72 @@ def get_gas_version(cc):
 warn(f'Could not recognize `gas`: {gas_ret}')
 return'0.0'
 
-defget_openssl_version():
+defget_openssl_macros(o):
+"""Extract OpenSSL preprocessor macros from the configured headers."""
+
+# Use the C compiler to extract preprocessor macros from OpenSSL headers.
+# crypto.h is included because BoringSSL declares OPENSSL_IS_BORINGSSL there.
+args= ['-E', '-dM',
+'-include', 'openssl/opensslv.h',
+'-include', 'openssl/crypto.h',
+'-']
+ifnotoptions.shared_openssl:
+args= ['-I', 'deps/openssl/openssl/include'] +args
+elifoptions.shared_openssl_includes:
+args= ['-I', options.shared_openssl_includes] +args
+else:
+fordirino['include_dirs']:
+args= ['-I', dir] +args
+
+proc=subprocess.Popen(
+shlex.split(CC) +args,
+stdin=subprocess.PIPE,
+stdout=subprocess.PIPE,
+stderr=subprocess.PIPE
+ )
+withproc:
+proc.stdin.write(b'\n')
+out=to_utf8(proc.communicate()[0])
+
+ifproc.returncode!=0:
+warn('Failed to extract OpenSSL macros from headers')
+return {}
+
+macros= {}
+forlineinout.split('\n'):
+ifline.startswith('#define OPENSSL_'):
+parts=line.split()
+iflen(parts) >=2:
+macro_name=parts[1]
+macro_value=parts[2] iflen(parts) >=3else'1'
+macros[macro_name] =macro_value
+
+returnmacros
+
+defget_openssl_version(o):
 """Parse OpenSSL version from opensslv.h header file.
 
  Returns the version as a number matching OPENSSL_VERSION_NUMBER format:
- 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre), L=0
+ 0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre),
+ L denotes as a long type literal
  """
 
 try:
-# Use the C compiler to extract preprocessor macros from opensslv.h
-args= ['-E', '-dM', '-include', 'openssl/opensslv.h', '-']
-ifnotoptions.shared_openssl:
-args= ['-I', 'deps/openssl/openssl/include'] +args
-elifoptions.shared_openssl_includes:
-args= ['-I', options.shared_openssl_includes] +args
-
-proc=subprocess.Popen(
-shlex.split(CC) +args,
-stdin=subprocess.PIPE,
-stdout=subprocess.PIPE,
-stderr=subprocess.PIPE
- )
-withproc:
-proc.stdin.write(b'\n')
-out=to_utf8(proc.communicate()[0])
-
-ifproc.returncode!=0:
-warn('Failed to extract OpenSSL version from opensslv.h header')
-return0
-
-# Parse the macro definitions
-macros= {}
-forlineinout.split('\n'):
-ifline.startswith('#define OPENSSL_VERSION_'):
-parts=line.split()
-iflen(parts) >=3:
-macro_name=parts[1]
-macro_value=parts[2]
-macros[macro_name] =macro_value
+macros=get_openssl_macros(o)
 
 # Extract version components
 major=int(macros.get('OPENSSL_VERSION_MAJOR', '0'))
 minor=int(macros.get('OPENSSL_VERSION_MINOR', '0'))
 patch=int(macros.get('OPENSSL_VERSION_PATCH', '0'))
 
+# If major, minor and patch are all 0, this is probably OpenSSL < 3.
+if (major, minor, patch) == (0, 0, 0):
+version_number=macros.get('OPENSSL_VERSION_NUMBER')
+# Prior to OpenSSL 3 the value should be in the format 0xMNN00PPSL.
+# If it is, we need to strip the `L` suffix prior to parsing.
+ifversion_number[:2] =="0x"andversion_number[-1] =="L":
+returnint(version_number[:-1], 16)
+
 # Check if it's a pre-release (has non-empty PRE_RELEASE string)
 pre_release=macros.get('OPENSSL_VERSION_PRE_RELEASE', '""').strip('"')
 status=0x0ifpre_releaseelse0xf
@@ -1387,6 +1409,13 @@ def get_openssl_version():
 warn(f'Failed to determine OpenSSL version from header: {e}')
 return0
 
+defget_openssl_is_boringssl(o):
+try:
+returnb('OPENSSL_IS_BORINGSSL'inget_openssl_macros(o))
+except (OSError, ValueError, subprocess.SubprocessError) ase:
+warn(f'Failed to determine whether OpenSSL headers are BoringSSL: {e}')
+return'false'
+
 # Note: Apple clang self-reports as clang 4.2.0 and gcc 4.2.1. It passes
 # the version check more by accident than anything else but a more rigorous
 # check involves checking the build number against an allowlist. I'm not
@@ -2065,7 +2094,8 @@ def without_ssl_error(option):
 
 configure_library('openssl', o)
 
-o['variables']['openssl_version'] =get_openssl_version()
+o['variables']['openssl_version'] =get_openssl_version(o)
+o['variables']['openssl_is_boringssl'] =get_openssl_is_boringssl(o)
 
 defconfigure_sqlite(o):
 o['variables']['node_use_sqlite'] =b(notoptions.without_sqlite)

deps/ncrypto/engine.cc

@@ -1,12 +1,18 @@
 #include"ncrypto.h"
 
+#if !defined(OPENSSL_NO_ENGINE) && \
+ ((defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT) || \
+NCRYPTO_USE_LEGACY_OPENSSL)
+#include<openssl/engine.h>
+#endif
+
 namespacencrypto {
 
 // ============================================================================
 // Engine
 
 #ifndef OPENSSL_NO_ENGINE
-EnginePointer::EnginePointer(ENGINE* engine_, bool finish_on_exit_)
+EnginePointer::EnginePointer(void* engine_, bool finish_on_exit_)
  : engine(engine_), finish_on_exit(finish_on_exit_) {}
 
 EnginePointer::EnginePointer(EnginePointer&& other) noexcept
@@ -24,21 +30,22 @@ EnginePointer& EnginePointer::operator=(EnginePointer&& other) noexcept {
 return *new (this) EnginePointer(std::move(other));
 }
 
-voidEnginePointer::reset(ENGINE* engine_, bool finish_on_exit_) {
+voidEnginePointer::reset(void* engine_, bool finish_on_exit_) {
 if (engine != nullptr) {
+ENGINE* current = static_cast<ENGINE*>(engine);
 if (finish_on_exit) {
 // This also does the equivalent of ENGINE_free.
-ENGINE_finish(engine);
+ENGINE_finish(current);
  } else {
-ENGINE_free(engine);
+ENGINE_free(current);
  }
  }
  engine = engine_;
  finish_on_exit = finish_on_exit_;
 }
 
-ENGINE* EnginePointer::release() {
-ENGINE* ret = engine;
+void* EnginePointer::release() {
+void* ret = engine;
  engine = nullptr;
  finish_on_exit = false;
 return ret;
@@ -52,8 +59,9 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 // Engine not found, try loading dynamically.
  engine = EnginePointer(ENGINE_by_id("dynamic"));
 if (engine) {
-if (!ENGINE_ctrl_cmd_string(engine.get(), "SO_PATH", name, 0) ||
- !ENGINE_ctrl_cmd_string(engine.get(), "LOAD", nullptr, 0)) {
+ENGINE* current = static_cast<ENGINE*>(engine.engine);
+if (!ENGINE_ctrl_cmd_string(current, "SO_PATH", name, 0) ||
+ !ENGINE_ctrl_cmd_string(current, "LOAD", nullptr, 0)) {
  engine.reset();
  }
  }
@@ -64,19 +72,24 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
 boolEnginePointer::setAsDefault(uint32_t flags, CryptoErrorList* errors) {
 if (engine == nullptr) returnfalse;
  ClearErrorOnReturn clear_error_on_return(errors);
-returnENGINE_set_default(engine, flags) != 0;
+returnENGINE_set_default(static_cast<ENGINE*>(engine), flags) != 0;
 }
 
 boolEnginePointer::init(bool finish_on_exit) {
 if (engine == nullptr) returnfalse;
 if (finish_on_exit) setFinishOnExit();
-returnENGINE_init(engine) == 1;
+returnENGINE_init(static_cast<ENGINE*>(engine)) == 1;
 }
 
 EVPKeyPointer EnginePointer::loadPrivateKey(constchar* key_name) {
 if (engine == nullptr) returnEVPKeyPointer();
-returnEVPKeyPointer(
-ENGINE_load_private_key(engine, key_name, nullptr, nullptr));
+returnEVPKeyPointer(ENGINE_load_private_key(
+static_cast<ENGINE*>(engine), key_name, nullptr, nullptr));
+}
+
+boolEnginePointer::setClientCertEngine(SSL_CTX* ctx) {
+if (engine == nullptr || ctx == nullptr) returnfalse;
+returnSSL_CTX_set_client_cert_engine(ctx, static_cast<ENGINE*>(engine)) == 1;
 }
 
 voidEnginePointer::initEnginesOnce() {