crypto,https,tls: end OpenSSL engine support

OpenSSL removed support for engines in version 4. Remove the Node.js
APIs, constants, native bindings, and implementation that depend on
ENGINE.

Keep recognizing the former TLS and HTTPS engine options so their use
fails explicitly instead of appearing to work while being ignored.

Move DEP0183 directly from Documentation-only to End-of-Life after
reverting its unreleased Runtime deprecation.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

Author: panva

deps/ncrypto/engine.cc

@@ -5,10 +5,6 @@
       'ncrypto.cc',
       'ncrypto.h',
     ],
-    'ncrypto_engine_sources': [
-      'engine.cc',
-      'ncrypto.h',
-    ],
     # OpenSSL may be configured with --api below 3.0. Keep 3.0 deprecation
     # checks where supported without exceeding its configured API level.
     'ncrypto_openssl3_api_compat':
@@ -17,11 +13,6 @@
       'OPENSSL_API_COMPAT=<(ncrypto_openssl3_api_compat)',
       'OPENSSL_NO_DEPRECATED',
     ],
-    'ncrypto_engine_defines': [
-      'OPENSSL_API_COMPAT=<(ncrypto_openssl3_api_compat)',
-      'OPENSSL_SUPPRESS_DEPRECATED',
-      'NCRYPTO_ENGINE_COMPAT=1',
-    ],
   },
   'targets': [
     {
@@ -46,9 +37,6 @@
       'conditions': [
         ['openssl_is_boringssl=="false"', {
           'defines': [ '<@(ncrypto_strict_defines)' ],
-          'dependencies': [
-            'ncrypto_engine',
-          ],
         }],
         ['node_shared_openssl=="false"', {
           'dependencies': [
@@ -58,27 +46,4 @@
       ]
     },
   ],
-  'conditions': [
-    ['openssl_is_boringssl=="false"', {
-      'targets': [
-        {
-          'target_name': 'ncrypto_engine',
-          'type': 'static_library',
-          'include_dirs': ['.'],
-          'defines': [
-            'NCRYPTO_BSSL_LIBDECREPIT_MISSING=<(ncrypto_bssl_libdecrepit_missing)',
-            '<@(ncrypto_engine_defines)',
-          ],
-          'sources': [ '<@(ncrypto_engine_sources)' ],
-          'conditions': [
-            ['node_shared_openssl=="false"', {
-              'dependencies': [
-                '../openssl/openssl.gyp:openssl'
-              ]
-            }],
-          ]
-        },
-      ],
-    }],
-  ],
 }

deps/ncrypto/ncrypto.gyp

@@ -23,11 +23,6 @@
 #include <string_view>
 #include <unordered_map>
 #include <vector>
-#if defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT &&                 \
-    !defined(OPENSSL_NO_ENGINE)
-#include <openssl/engine.h>
-#endif  // NCRYPTO_ENGINE_COMPAT && !OPENSSL_NO_ENGINE
-
 #ifndef OPENSSL_VERSION_PREREQ
 #define OPENSSL_VERSION_PREREQ(maj, min)                                       \
   (OPENSSL_VERSION_NUMBER >= (((maj) << 28) | ((min) << 20)))
@@ -2109,44 +2104,6 @@ class MacCache final {
 };
 #endif
 
-#ifndef OPENSSL_NO_ENGINE
-class EnginePointer final {
- public:
-  EnginePointer() = default;
-
-  explicit EnginePointer(void* engine_, bool finish_on_exit = false);
-  EnginePointer(EnginePointer&& other) noexcept;
-  EnginePointer& operator=(EnginePointer&& other) noexcept;
-  NCRYPTO_DISALLOW_COPY(EnginePointer)
-  ~EnginePointer();
-
-  inline operator bool() const { return engine != nullptr; }
-  inline void setFinishOnExit() { finish_on_exit = true; }
-
-  void reset(void* engine_ = nullptr, bool finish_on_exit_ = false);
-
-  bool setAsDefault(uint32_t flags, CryptoErrorList* errors = nullptr);
-  bool init(bool finish_on_exit = false);
-  EVPKeyPointer loadPrivateKey(const char* key_name);
-  bool setClientCertEngine(SSL_CTX* ctx);
-
-  void* release();
-
-  // Retrieve an OpenSSL Engine instance by name. If the name does not
-  // identify a valid named engine, the returned EnginePointer will be
-  // empty.
-  static EnginePointer getEngineByName(const char* name,
-                                       CryptoErrorList* errors = nullptr);
-
-  // Call once when initializing OpenSSL at startup for the process.
-  static void initEnginesOnce();
-
- private:
-  void* engine = nullptr;
-  bool finish_on_exit = false;
-};
-#endif  // !OPENSSL_NO_ENGINE
-
 // ============================================================================
 // FIPS
 bool isFipsEnabled();

deps/ncrypto/ncrypto.h

@@ -26,11 +26,7 @@ template("ncrypto_gn_build") {
   source_set(target_name) {
     forward_variables_from(invoker, "*")
     public_configs = [ ":ncrypto_config" ]
-    defines = [
-      "NCRYPTO_ENGINE_COMPAT=1",
-      "OPENSSL_SUPPRESS_DEPRECATED",
-    ]
-    sources = gypi_values.ncrypto_sources + gypi_values.ncrypto_engine_sources
+    sources = gypi_values.ncrypto_sources
     deps = [ "$node_openssl_path" ]
   }
 }

deps/ncrypto/unofficial.gni

@@ -6601,42 +6601,6 @@ added: v15.6.0
   * `utilization` {number} The calculated ratio of `used` to `total`
     allocated bytes.
 
-### `crypto.setEngine(engine[, flags])`
-
-<!-- YAML
-added: v0.11.11
-changes:
-  - version:
-    - v22.4.0
-    - v20.16.0
-    pr-url: https://github.com/nodejs/node/pull/53329
-    description: Custom engine support in OpenSSL 3 is deprecated.
--->
-
-* `engine` {string}
-* `flags` {crypto.constants} **Default:** `crypto.constants.ENGINE_METHOD_ALL`
-
-Load and set the `engine` for some or all OpenSSL functions (selected by flags).
-Support for custom engines in OpenSSL is deprecated from OpenSSL 3.
-
-`engine` could be either an id or a path to the engine's shared library.
-
-The optional `flags` argument uses `ENGINE_METHOD_ALL` by default. The `flags`
-is a bit field taking one of or a mix of the following flags (defined in
-`crypto.constants`):
-
-* `crypto.constants.ENGINE_METHOD_RSA`
-* `crypto.constants.ENGINE_METHOD_DSA`
-* `crypto.constants.ENGINE_METHOD_DH`
-* `crypto.constants.ENGINE_METHOD_RAND`
-* `crypto.constants.ENGINE_METHOD_EC`
-* `crypto.constants.ENGINE_METHOD_CIPHERS`
-* `crypto.constants.ENGINE_METHOD_DIGESTS`
-* `crypto.constants.ENGINE_METHOD_PKEY_METHS`
-* `crypto.constants.ENGINE_METHOD_PKEY_ASN1_METHS`
-* `crypto.constants.ENGINE_METHOD_ALL`
-* `crypto.constants.ENGINE_METHOD_NONE`
-
 ### `crypto.setFips(bool)`
 
 <!-- YAML
@@ -7463,59 +7427,6 @@ See the [list of SSL OP Flags][] for details.
   </tr>
 </table>
 
-### OpenSSL engine constants
-
-<table>
-  <tr>
-    <th>Constant</th>
-    <th>Description</th>
-  </tr>
-  <tr>
-    <td><code>ENGINE_METHOD_RSA</code></td>
-    <td>Limit engine usage to RSA</td>
-  </tr>
-  <tr>
-    <td><code>ENGINE_METHOD_DSA</code></td>
-    <td>Limit engine usage to DSA</td>
-  </tr>
-  <tr>
-    <td><code>ENGINE_METHOD_DH</code></td>
-    <td>Limit engine usage to DH</td>
-  </tr>
-  <tr>
-    <td><code>ENGINE_METHOD_RAND</code></td>
-    <td>Limit engine usage to RAND</td>
-  </tr>
-  <tr>
-    <td><code>ENGINE_METHOD_EC</code></td>
-    <td>Limit engine usage to EC</td>
-  </tr>
-  <tr>
-    <td><code>ENGINE_METHOD_CIPHERS</code></td>
-    <td>Limit engine usage to CIPHERS</td>
-  </tr>
-  <tr>
-    <td><code>ENGINE_METHOD_DIGESTS</code></td>
-    <td>Limit engine usage to DIGESTS</td>
-  </tr>
-  <tr>
-    <td><code>ENGINE_METHOD_PKEY_METHS</code></td>
-    <td>Limit engine usage to PKEY_METHS</td>
-  </tr>
-  <tr>
-    <td><code>ENGINE_METHOD_PKEY_ASN1_METHS</code></td>
-    <td>Limit engine usage to PKEY_ASN1_METHS</td>
-  </tr>
-  <tr>
-    <td><code>ENGINE_METHOD_ALL</code></td>
-    <td></td>
-  </tr>
-  <tr>
-    <td><code>ENGINE_METHOD_NONE</code></td>
-    <td></td>
-  </tr>
-</table>
-
 ### Other OpenSSL constants
 
 <table>

doc/api/crypto.md

@@ -4111,20 +4111,25 @@ that are shorter than the default authentication tag length (i.e., shorter than
 
 <!-- YAML
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64777
+    description: End-of-Life.
   - version:
     - v22.4.0
     - v20.16.0
     pr-url: https://github.com/nodejs/node/pull/53329
     description: Documentation-only deprecation.
 -->
 
-Type: Documentation-only
+Type: End-of-Life
 
-OpenSSL 3 has deprecated support for custom engines with a recommendation to
-switch to its new provider model. The `clientCertEngine` option for
-`https.request()`, [`tls.createSecureContext()`][], and [`tls.createServer()`][];
-the `privateKeyEngine` and `privateKeyIdentifier` for [`tls.createSecureContext()`][];
-and [`crypto.setEngine()`][] all depend on this functionality from OpenSSL.
+The `crypto.setEngine()` API and the `crypto.constants.ENGINE_METHOD_*`
+constants have been removed. The `clientCertEngine` option for
+[`https.request()`][], [`tls.createSecureContext()`][], and
+[`tls.createServer()`][] and the `privateKeyEngine` and `privateKeyIdentifier`
+options for [`tls.createSecureContext()`][] now throw
+`ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED` when used. There is no direct
+replacement API in Node.js. OpenSSL's provider model replaces engines upstream.
 
 ### DEP0184: Instantiating `node:zlib` classes without `new`
 
@@ -4887,7 +4892,6 @@ Type: Documentation-only
 [`crypto.pbkdf2()`]: crypto.md#cryptopbkdf2password-salt-iterations-keylen-digest-callback
 [`crypto.randomBytes()`]: crypto.md#cryptorandombytessize-callback
 [`crypto.scrypt()`]: crypto.md#cryptoscryptpassword-salt-keylen-options-callback
-[`crypto.setEngine()`]: crypto.md#cryptosetengineengine-flags
 [`decipher.final()`]: crypto.md#decipherfinaloutputencoding
 [`decipher.setAuthTag()`]: crypto.md#deciphersetauthtagbuffer-encoding
 [`dirent.parentPath`]: fs.md#direntparentpath