Node.js OpenSSL headers much larger after OpenSSL 3 switch over

[richardlau]

Version

v17 and master

Platform

No response

Subsystem

build

What steps will reproduce the bug?

Download and unpack a headers package, e.g. https://nodejs.org/dist/v17.5.0/node-v17.5.0-headers.tar.gz.

How often does it reproduce? Is there a required condition?

N/A

What is the expected behavior?

No response

What do you see instead?

The size of the unpacked headers is 64 Mb whereas earlier versions, e.g. v16.14.0, are around 7 Mb.

Additional information

Noticed while tidying up disk space on one of the CI machines, nodejs/build#2695 (comment)

7.0M .cache/node-gyp/17.0.0-nightly20211008dbc91de011
7.0M .cache/node-gyp/17.0.0-nightly20211009879ff775d0
7.0M .cache/node-gyp/17.0.0-nightly202110108068f40313
67M .cache/node-gyp/17.0.0-nightly202110110cc37209fa
67M .cache/node-gyp/17.0.0-nightly20211012a784258444
67M .cache/node-gyp/17.0.0-nightly20211013f570109094

A cursory glance at the changes 8068f40...0cc3720 would suggest that the large increase in size was the OpenSSL 3 switchover.

An initial look suggests the differences are in include/node/openssl/archs/:

$ du -hs /tmp/node-headers/node-v16.14.0/include/node/openssl/archs/
2.7M /tmp/node-headers/node-v16.14.0/include/node/openssl/archs/
$ du -hs /tmp/node-headers/node-v17.5.0/include/node/openssl/archs/
61M /tmp/node-headers/node-v17.5.0/include/node/openssl/archs/
$

and looking at one arch:

$ ls /tmp/node-headers/node-v16.14.0/include/node/openssl/archs/BSD-x86/no-asm/include/openssl/ -al
total 8
drwxr-xr-x. 2 rlau rlau 27 Feb 8 07:46 .
drwxr-xr-x. 3 rlau rlau 36 Feb 8 07:46 ..
-rw-r--r--. 1 rlau rlau 4703 Oct 14 01:50 opensslconf.h
$ ls /tmp/node-headers/node-v17.5.0/include/node/openssl/archs/BSD-x86/no-asm/include/openssl/ -al
total 840
drwxr-xr-x. 2 rlau rlau 4096 Feb 10 00:10 .
drwxr-xr-x. 4 rlau rlau 50 Feb 10 00:10 ..
-rw-r--r--. 1 rlau rlau 60914 Feb 8 23:02 asn1.h
-rw-r--r--. 1 rlau rlau 35937 Feb 8 23:02 asn1t.h
-rw-r--r--. 1 rlau rlau 39689 Feb 8 23:02 bio.h
-rw-r--r--. 1 rlau rlau 40773 Feb 8 23:02 cmp.h
-rw-r--r--. 1 rlau rlau 34081 Feb 8 23:02 cms.h
-rw-r--r--. 1 rlau rlau 10485 Feb 8 23:02 conf.h
-rw-r--r--. 1 rlau rlau 3013 Feb 8 23:02 configuration.h
-rw-r--r--. 1 rlau rlau 14644 Feb 8 23:02 crmf.h
-rw-r--r--. 1 rlau rlau 23819 Feb 8 23:02 crypto.h
-rw-r--r--. 1 rlau rlau 22765 Feb 8 23:02 ct.h
-rw-r--r--. 1 rlau rlau 21089 Feb 8 23:02 err.h
-rw-r--r--. 1 rlau rlau 8968 Feb 8 23:02 ess.h
-rw-r--r--. 1 rlau rlau 1010 Feb 8 23:02 fipskey.h
-rw-r--r--. 1 rlau rlau 14061 Feb 8 23:02 lhash.h
-rw-r--r--. 1 rlau rlau 29352 Feb 8 23:02 ocsp.h
-rw-r--r--. 1 rlau rlau 4703 Oct 14 01:50 opensslconf.h
-rw-r--r--. 1 rlau rlau 3204 Feb 8 23:02 opensslv.h
-rw-r--r--. 1 rlau rlau 19316 Feb 8 23:02 pkcs12.h
-rw-r--r--. 1 rlau rlau 22333 Feb 8 23:02 pkcs7.h
-rw-r--r--. 1 rlau rlau 18439 Feb 8 23:02 safestack.h
-rw-r--r--. 1 rlau rlau 15487 Feb 8 23:02 srp.h
-rw-r--r--. 1 rlau rlau 127071 Feb 8 23:02 ssl.h
-rw-r--r--. 1 rlau rlau 19251 Feb 8 23:02 ui.h
-rw-r--r--. 1 rlau rlau 71533 Feb 8 23:02 x509.h
-rw-r--r--. 1 rlau rlau 52027 Feb 8 23:02 x509_vfy.h
-rw-r--r--. 1 rlau rlau 93966 Feb 8 23:02 x509v3.h
$

[danbev]

OpenSSL 3.x has a number of header files that are generated and are architecture specific. These headers are generated as part of Node.js OpenSSL update process and the generated header files are checked in.

In earlier version there were only two files (or something like that) that got generated but this has increased in OpenSSL 3.x where there are more, for example on Linux there following list is generated in the perl module configdata.pm by the configure step:

 "depends" => { 
 "" => [ 
 "include/crypto/bn_conf.h", 
 "include/crypto/dso_conf.h", 
 "include/openssl/asn1.h", 
 "include/openssl/asn1t.h", 
 "include/openssl/bio.h", 
 "include/openssl/cmp.h", 
 "include/openssl/cms.h", 
 "include/openssl/conf.h", 
 "include/openssl/configuration.h", 
 "include/openssl/crmf.h", 
 "include/openssl/crypto.h", 
 "include/openssl/ct.h", 
 "include/openssl/err.h", 
 "include/openssl/ess.h", 
 "include/openssl/fipskey.h", 
 "include/openssl/lhash.h", 
 "include/openssl/ocsp.h", 
 "include/openssl/opensslv.h", 
 "include/openssl/pkcs12.h", 
 "include/openssl/pkcs7.h", 
 "include/openssl/safestack.h", 
 "include/openssl/srp.h", 
 "include/openssl/ssl.h", 
 "include/openssl/ui.h", 
 "include/openssl/x509.h", 
 "include/openssl/x509_vfy.h", 
 "include/openssl/x509v3.h", 
 "test/provider_internal_test.cnf" 
 ], 

This list will then be used by the makefile template, Configurations/unix-Makefile.tmpl in the Linux case, and will generate the following variable:

GENERATED_MANDATORY=include/crypto/bn_conf.h include/crypto/dso_conf.h \ 
 include/openssl/asn1.h include/openssl/asn1t.h \ 
 include/openssl/bio.h include/openssl/cmp.h \ 
 include/openssl/cms.h include/openssl/conf.h \ 
 include/openssl/configuration.h include/openssl/crmf.h \ 
 include/openssl/crypto.h include/openssl/ct.h \ 
 include/openssl/err.h include/openssl/ess.h \ 
 include/openssl/fipskey.h include/openssl/lhash.h \ 
 include/openssl/ocsp.h include/openssl/opensslv.h \ 
 include/openssl/pkcs12.h include/openssl/pkcs7.h \ 
 include/openssl/safestack.h include/openssl/srp.h \ 
 include/openssl/ssl.h include/openssl/ui.h \ 
 include/openssl/x509.h include/openssl/x509_vfy.h \ 
 include/openssl/x509v3.h test/provider_internal_test.cnf

And in Node.js the output of these targets are placed in the architecture specific directories below deps/openssl/config/archs

$ ls -lh archs/linux-x86_64/asm/include/openssl/
total 836K
-rw-rw-r--. 1 danielbevenius danielbevenius 60K Oct 19 10:14 asn1.h
-rw-rw-r--. 1 danielbevenius danielbevenius 36K Oct 19 10:14 asn1t.h
-rw-rw-r--. 1 danielbevenius danielbevenius 39K Apr 3 16:14 bio.h
-rw-rw-r--. 1 danielbevenius danielbevenius 40K Oct 19 10:14 cmp.h
-rw-rw-r--. 1 danielbevenius danielbevenius 34K Oct 19 10:14 cms.h
-rw-rw-r--. 1 danielbevenius danielbevenius 11K Oct 19 10:14 conf.h
-rw-rw-r--. 1 danielbevenius danielbevenius 3.0K Oct 19 10:14 configuration.h
-rw-rw-r--. 1 danielbevenius danielbevenius 15K Oct 19 10:14 crmf.h
-rw-rw-r--. 1 danielbevenius danielbevenius 24K Apr 3 16:14 crypto.h
-rw-rw-r--. 1 danielbevenius danielbevenius 23K Oct 19 10:14 ct.h
-rw-rw-r--. 1 danielbevenius danielbevenius 21K Oct 19 10:14 err.h
-rw-rw-r--. 1 danielbevenius danielbevenius 8.8K Oct 19 10:14 ess.h
-rw-rw-r--. 1 danielbevenius danielbevenius 1010 Oct 19 10:14 fipskey.h
-rw-rw-r--. 1 danielbevenius danielbevenius 14K Oct 19 10:14 lhash.h
-rw-rw-r--. 1 danielbevenius danielbevenius 29K Oct 19 10:14 ocsp.h
-rw-rw-r--. 1 danielbevenius danielbevenius 4.7K Apr 12 2021 opensslconf.h
-rw-rw-r--. 1 danielbevenius danielbevenius 3.2K Apr 3 16:14 opensslv.h
-rw-rw-r--. 1 danielbevenius danielbevenius 19K Oct 19 10:14 pkcs12.h
-rw-rw-r--. 1 danielbevenius danielbevenius 22K Oct 19 10:14 pkcs7.h
-rw-rw-r--. 1 danielbevenius danielbevenius 19K Oct 19 10:14 safestack.h
-rw-rw-r--. 1 danielbevenius danielbevenius 16K Oct 19 10:14 srp.h
-rw-rw-r--. 1 danielbevenius danielbevenius 125K Apr 3 16:14 ssl.h
-rw-rw-r--. 1 danielbevenius danielbevenius 19K Oct 19 10:14 ui.h
-rw-rw-r--. 1 danielbevenius danielbevenius 70K Oct 19 10:14 x509.h
-rw-rw-r--. 1 danielbevenius danielbevenius 92K Oct 19 10:14 x509v3.h
-rw-rw-r--. 1 danielbevenius danielbevenius 51K Oct 19 10:14 x509_vfy.h

There are 24 archs/assembly language in deps/openssl/config/arch and each have asm, asm_avx2, and no-asm directories were these headers are copied. So that I think would account for this increase in size:

(24 * (3 * 840000))/1000000
60

So this is not a case of having included headers by mistake in someway but is intentional.

One option is that it might be possible to instead of copying these file into the three directories, create a directory named archs/linux-x86_64/common, where we place the include files and then have the include files in the sub-directories include these headers.

With the changes in the linked pull request the size if down to

$ du -hs node-v18.0.0/include/node/openssl/archs/
37M	node-v18.0.0/include/node/openssl/archs/

[mhdawson]

When you say 24 archs/compiler types, do we support all of those in Node.js? Without looking it sounds like a lot but maybe it is what we support, just wanted to ask in case we might be able to remove some of them.

[danbev]

When you say 24 archs/compiler types, do we support all of those in Node.js?

Sorry, that was confusing. It should really be assembly language supported I think (I'm not I'm using the correct terminology here). For each architecture we have asm, asm_avx2, and no-asm. I'll update the comment above.