Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 86b93412c2ed0729569d01cef74410c689827f2e
https://github.com/WebKit/WebKit/commit/86b93412c2ed0729569d01cef74410c689827f2e
Author: Tom Greenslade <[email protected]>
Date: 2026-07-22 (Wed, 22 Jul 2026)
Changed paths:
M Source/WebCore/crypto/openssl/CryptoAlgorithmAESGCMOpenSSL.cpp
M Source/WebCore/crypto/openssl/CryptoAlgorithmRSA_OAEPOpenSSL.cpp
M Source/WebCore/crypto/openssl/CryptoAlgorithmRSA_PSSOpenSSL.cpp
M Source/WebCore/crypto/openssl/CryptoKeyRSAOpenSSL.cpp
Log Message:
-----------
OpenSSL 3.x compatibility improvements
https://bugs.webkit.org/show_bug.cgi?id=319982
Reviewed by Patrick Griffis.
Problems fixed:
1)
const usage in Source/WebCore/crypto/openssl/CryptoKeyRSAOpenSSL.cpp
https://docs.openssl.org/3.0/man7/migration_guide/#functions-that-return-an-internal-key-should-be-treated-as-read-only
"the value returned from EVP_PKEY_get0_RSA(3), ... have been made const"
2)
Feature test ifdefs in
Source/WebCore/crypto/openssl/CryptoAlgorithmRSA_OAEPOpenSSL.cpp no longer work
https://github.com/WebKit/WebKit/blob/6d8ca7e79a097c2013cf960c16489930cad90f11/Source/WebCore/crypto/openssl/CryptoAlgorithmRSA_OAEPOpenSSL.cpp#L39
These were macros in OpenSSL 1.x, but are now real functions in OpenSSL 3.x:
https://docs.openssl.org/3.0/man3/EVP_PKEY_CTX_ctrl/#history "In OpenSSL 1.1.1
and below the functions were mostly macros. From OpenSSL 3.0 they are all
functions."
So the ifdefs do not see the macros defined (because they are now functions),
so the code incorrectly returns ExceptionCode::NotSupportedError.
The solution is to remove these feature checks, surely no one is still using
OpenSSL 0.x from before these were added as macros.
3)
Runtime GCM failures. In
Source/WebCore/crypto/openssl/CryptoAlgorithmAESGCMOpenSSL.cpp
EVP_CIPHER_CTX_set_padding() is called *before*
EVP_EncryptInit_ex() and EVP_DecryptInit_ex().
The OpenSSL documentation says:
"This function should be called after the context is set up for encryption or
decryption"
https://docs.openssl.org/3.0/man3/EVP_EncryptInit/#description .
In OpenSSL 1.x this did not matter because EVP_EncryptInit_ex() always returned
1:
https://github.com/openssl/openssl/blob/OpenSSL_1_1_1-stable/crypto/evp/evp_enc.c#L650
,
but in OpenSSL 3.x it can return 0 if it is called incorrectly, as here with a
null ctx->cipher.
The solution is to move the function calls after the init functions.
No new tests: fixes behaviour in non default configuration
* Source/WebCore/crypto/openssl/CryptoAlgorithmAESGCMOpenSSL.cpp: move
EVP_CIPHER_CTX_set_padding() calls
(WebCore::cryptEncrypt): move EVP_CIPHER_CTX_set_padding() call after
EVP_EncryptInit_ex()
(WebCore::cryptDecrypt): move EVP_CIPHER_CTX_set_padding() call after
EVP_DecryptInit_ex()
* Source/WebCore/crypto/openssl/CryptoAlgorithmRSA_OAEPOpenSSL.cpp: delete
broken feature check #ifs
(WebCore::CryptoAlgorithmRSA_OAEP::platformEncrypt): delete broken feature
check #if
(WebCore::CryptoAlgorithmRSA_OAEP::platformDecrypt): delete broken feature
check #if
* Source/WebCore/crypto/openssl/CryptoAlgorithmRSA_PSSOpenSSL.cpp: delete
broken feature check #ifs
(WebCore::CryptoAlgorithmRSA_PSS::platformSign): delete broken feature check #if
(WebCore::CryptoAlgorithmRSA_PSS::platformVerify): delete broken feature check
#if
* Source/WebCore/crypto/openssl/CryptoKeyRSAOpenSSL.cpp: Add const to match
OpenSSL 3.x API changes
(WebCore::getRSAModulusLength): add const
(WebCore::CryptoKeyRSA::keySizeInBits const): add const
(WebCore::CryptoKeyRSA::algorithm const): add const
(WebCore::CryptoKeyRSA::exportData const): add const
Canonical link: https://commits.webkit.org/317719@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
