Node.js OpenSSL headers much larger after OpenSSL 3 switch over

[richardlau]

Version

v17 and master

Platform

No response

Subsystem

build

What steps will reproduce the bug?

Download and unpack a headers package, e.g. https://nodejs.org/dist/v17.5.0/node-v17.5.0-headers.tar.gz.

How often does it reproduce? Is there a required condition?

N/A

What is the expected behavior?

No response

What do you see instead?

The size of the unpacked headers is 64 Mb whereas earlier versions, e.g. v16.14.0, are around 7 Mb.

Additional information

Noticed while tidying up disk space on one of the CI machines, nodejs/build#2695 (comment)

7.0M    .cache/node-gyp/17.0.0-nightly20211008dbc91de011
7.0M    .cache/node-gyp/17.0.0-nightly20211009879ff775d0
7.0M    .cache/node-gyp/17.0.0-nightly202110108068f40313
67M     .cache/node-gyp/17.0.0-nightly202110110cc37209fa
67M     .cache/node-gyp/17.0.0-nightly20211012a784258444
67M     .cache/node-gyp/17.0.0-nightly20211013f570109094

A cursory glance at the changes 8068f40...0cc3720 would suggest that the large increase in size was the OpenSSL 3 switchover.

An initial look suggests the differences are in include/node/openssl/archs/:

$ du -hs /tmp/node-headers/node-v16.14.0/include/node/openssl/archs/
2.7M    /tmp/node-headers/node-v16.14.0/include/node/openssl/archs/
$ du -hs /tmp/node-headers/node-v17.5.0/include/node/openssl/archs/
61M     /tmp/node-headers/node-v17.5.0/include/node/openssl/archs/
$

and looking at one arch:

$ ls /tmp/node-headers/node-v16.14.0/include/node/openssl/archs/BSD-x86/no-asm/include/openssl/ -al
total 8
drwxr-xr-x. 2 rlau rlau   27 Feb  8 07:46 .
drwxr-xr-x. 3 rlau rlau   36 Feb  8 07:46 ..
-rw-r--r--. 1 rlau rlau 4703 Oct 14 01:50 opensslconf.h
$ ls /tmp/node-headers/node-v17.5.0/include/node/openssl/archs/BSD-x86/no-asm/include/openssl/ -al
total 840
drwxr-xr-x. 2 rlau rlau   4096 Feb 10 00:10 .
drwxr-xr-x. 4 rlau rlau     50 Feb 10 00:10 ..
-rw-r--r--. 1 rlau rlau  60914 Feb  8 23:02 asn1.h
-rw-r--r--. 1 rlau rlau  35937 Feb  8 23:02 asn1t.h
-rw-r--r--. 1 rlau rlau  39689 Feb  8 23:02 bio.h
-rw-r--r--. 1 rlau rlau  40773 Feb  8 23:02 cmp.h
-rw-r--r--. 1 rlau rlau  34081 Feb  8 23:02 cms.h
-rw-r--r--. 1 rlau rlau  10485 Feb  8 23:02 conf.h
-rw-r--r--. 1 rlau rlau   3013 Feb  8 23:02 configuration.h
-rw-r--r--. 1 rlau rlau  14644 Feb  8 23:02 crmf.h
-rw-r--r--. 1 rlau rlau  23819 Feb  8 23:02 crypto.h
-rw-r--r--. 1 rlau rlau  22765 Feb  8 23:02 ct.h
-rw-r--r--. 1 rlau rlau  21089 Feb  8 23:02 err.h
-rw-r--r--. 1 rlau rlau   8968 Feb  8 23:02 ess.h
-rw-r--r--. 1 rlau rlau   1010 Feb  8 23:02 fipskey.h
-rw-r--r--. 1 rlau rlau  14061 Feb  8 23:02 lhash.h
-rw-r--r--. 1 rlau rlau  29352 Feb  8 23:02 ocsp.h
-rw-r--r--. 1 rlau rlau   4703 Oct 14 01:50 opensslconf.h
-rw-r--r--. 1 rlau rlau   3204 Feb  8 23:02 opensslv.h
-rw-r--r--. 1 rlau rlau  19316 Feb  8 23:02 pkcs12.h
-rw-r--r--. 1 rlau rlau  22333 Feb  8 23:02 pkcs7.h
-rw-r--r--. 1 rlau rlau  18439 Feb  8 23:02 safestack.h
-rw-r--r--. 1 rlau rlau  15487 Feb  8 23:02 srp.h
-rw-r--r--. 1 rlau rlau 127071 Feb  8 23:02 ssl.h
-rw-r--r--. 1 rlau rlau  19251 Feb  8 23:02 ui.h
-rw-r--r--. 1 rlau rlau  71533 Feb  8 23:02 x509.h
-rw-r--r--. 1 rlau rlau  52027 Feb  8 23:02 x509_vfy.h
-rw-r--r--. 1 rlau rlau  93966 Feb  8 23:02 x509v3.h
$

[danbev]

OpenSSL 3.x has a number of header files that are generated and are architecture specific. These headers are generated as part of Node.js OpenSSL update process and the generated header files are checked in.

In earlier version there were only two files (or something like that) that got generated but this has increased in OpenSSL 3.x where there are more, for example on Linux there following list is generated in the perl module configdata.pm by the configure step:

  "depends" => {                                                              
        "" => [                                                                 
            "include/crypto/bn_conf.h",                                         
            "include/crypto/dso_conf.h",                                        
            "include/openssl/asn1.h",                                           
            "include/openssl/asn1t.h",                                          
            "include/openssl/bio.h",                                            
            "include/openssl/cmp.h",                                            
            "include/openssl/cms.h",                                            
            "include/openssl/conf.h",                                           
            "include/openssl/configuration.h",                                  
            "include/openssl/crmf.h",                                           
            "include/openssl/crypto.h",                                         
            "include/openssl/ct.h",                                             
            "include/openssl/err.h",                                            
            "include/openssl/ess.h",                                            
            "include/openssl/fipskey.h",                                        
            "include/openssl/lhash.h",                                          
            "include/openssl/ocsp.h",                                           
            "include/openssl/opensslv.h",                                       
            "include/openssl/pkcs12.h",                                         
            "include/openssl/pkcs7.h",                                          
            "include/openssl/safestack.h",                                      
            "include/openssl/srp.h",                                            
            "include/openssl/ssl.h",                                            
            "include/openssl/ui.h",                                             
            "include/openssl/x509.h",                                           
            "include/openssl/x509_vfy.h",                                       
            "include/openssl/x509v3.h",                                         
            "test/provider_internal_test.cnf"                                   
        ],                                         

This list will then be used by the makefile template, Configurations/unix-Makefile.tmpl in the Linux case, and will generate the following variable:

GENERATED_MANDATORY=include/crypto/bn_conf.h include/crypto/dso_conf.h \             
                    include/openssl/asn1.h include/openssl/asn1t.h \                 
                    include/openssl/bio.h include/openssl/cmp.h \                    
                    include/openssl/cms.h include/openssl/conf.h \                   
                    include/openssl/configuration.h include/openssl/crmf.h \     
                    include/openssl/crypto.h include/openssl/ct.h \                  
                    include/openssl/err.h include/openssl/ess.h \                    
                    include/openssl/fipskey.h include/openssl/lhash.h \              
                    include/openssl/ocsp.h include/openssl/opensslv.h \              
                    include/openssl/pkcs12.h include/openssl/pkcs7.h \               
                    include/openssl/safestack.h include/openssl/srp.h \              
                    include/openssl/ssl.h include/openssl/ui.h \                     
                    include/openssl/x509.h include/openssl/x509_vfy.h \              
                    include/openssl/x509v3.h test/provider_internal_test.cnf

And in Node.js the output of these targets are placed in the architecture specific directories below deps/openssl/config/archs

$ ls  -lh archs/linux-x86_64/asm/include/openssl/
total 836K
-rw-rw-r--. 1 danielbevenius danielbevenius  60K Oct 19 10:14 asn1.h
-rw-rw-r--. 1 danielbevenius danielbevenius  36K Oct 19 10:14 asn1t.h
-rw-rw-r--. 1 danielbevenius danielbevenius  39K Apr  3 16:14 bio.h
-rw-rw-r--. 1 danielbevenius danielbevenius  40K Oct 19 10:14 cmp.h
-rw-rw-r--. 1 danielbevenius danielbevenius  34K Oct 19 10:14 cms.h
-rw-rw-r--. 1 danielbevenius danielbevenius  11K Oct 19 10:14 conf.h
-rw-rw-r--. 1 danielbevenius danielbevenius 3.0K Oct 19 10:14 configuration.h
-rw-rw-r--. 1 danielbevenius danielbevenius  15K Oct 19 10:14 crmf.h
-rw-rw-r--. 1 danielbevenius danielbevenius  24K Apr  3 16:14 crypto.h
-rw-rw-r--. 1 danielbevenius danielbevenius  23K Oct 19 10:14 ct.h
-rw-rw-r--. 1 danielbevenius danielbevenius  21K Oct 19 10:14 err.h
-rw-rw-r--. 1 danielbevenius danielbevenius 8.8K Oct 19 10:14 ess.h
-rw-rw-r--. 1 danielbevenius danielbevenius 1010 Oct 19 10:14 fipskey.h
-rw-rw-r--. 1 danielbevenius danielbevenius  14K Oct 19 10:14 lhash.h
-rw-rw-r--. 1 danielbevenius danielbevenius  29K Oct 19 10:14 ocsp.h
-rw-rw-r--. 1 danielbevenius danielbevenius 4.7K Apr 12  2021 opensslconf.h
-rw-rw-r--. 1 danielbevenius danielbevenius 3.2K Apr  3 16:14 opensslv.h
-rw-rw-r--. 1 danielbevenius danielbevenius  19K Oct 19 10:14 pkcs12.h
-rw-rw-r--. 1 danielbevenius danielbevenius  22K Oct 19 10:14 pkcs7.h
-rw-rw-r--. 1 danielbevenius danielbevenius  19K Oct 19 10:14 safestack.h
-rw-rw-r--. 1 danielbevenius danielbevenius  16K Oct 19 10:14 srp.h
-rw-rw-r--. 1 danielbevenius danielbevenius 125K Apr  3 16:14 ssl.h
-rw-rw-r--. 1 danielbevenius danielbevenius  19K Oct 19 10:14 ui.h
-rw-rw-r--. 1 danielbevenius danielbevenius  70K Oct 19 10:14 x509.h
-rw-rw-r--. 1 danielbevenius danielbevenius  92K Oct 19 10:14 x509v3.h
-rw-rw-r--. 1 danielbevenius danielbevenius  51K Oct 19 10:14 x509_vfy.h

There are 24 archs/assembly language in deps/openssl/config/arch and each have asm, asm_avx2, and no-asm directories were these headers are copied. So that I think would account for this increase in size:

(24 * (3 * 840000))/1000000
60

So this is not a case of having included headers by mistake in someway but is intentional.

One option is that it might be possible to instead of copying these file into the three directories, create a directory named archs/linux-x86_64/common, where we place the include files and then have the include files in the sub-directories include these headers.

With the changes in the linked pull request the size if down to

$ du -hs node-v18.0.0/include/node/openssl/archs/
37M	node-v18.0.0/include/node/openssl/archs/

[mhdawson]

When you say 24 archs/compiler types, do we support all of those in Node.js? Without looking it sounds like a lot but maybe it is what we support, just wanted to ask in case we might be able to remove some of them.

[danbev]

When you say 24 archs/compiler types, do we support all of those in Node.js?

Sorry, that was confusing. It should really be assembly language supported I think (I'm not I'm using the correct terminology here). For each architecture we have asm, asm_avx2, and no-asm. I'll update the comment above.