deps: upgrade OpenSSL to version 1.0.2l #13233

danbev · 2017-05-26T06:30:24Z

This pull request contains commits to upgrade OpenSSL to version 1.0.2.l

This includes commits following the instructions in Upgrading OpenSSL, and also reverts f439065 as mentioned in #13161.

Fixes: #13161

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
commit message follows commit guidelines

Affected core subsystem(s)

deps, crypto

mscdex · 2017-05-26T06:33:10Z

deps/openssl/config/archs/aix-gcc/opensslconf.h

@@ -235,7 +235,7 @@ extern "C" {
   even newer MIPS CPU's, but at the moment one size fits all for
   optimization options.  Older Sparc's work better with only UNROLL, but
   there's no way to tell at compile time what it is you're running on */
-
+ 


Are these changes necessary?

I was not sure and thought it would be better to be safe than sorry and get feedback on the PR first. Let me know and I'll remove that commit. Thanks

OpenSSL Configure generates this whitespace but it is always removed with git am --whitespace=fix. So we can left it as it will be removed.

mscdex · 2017-05-26T06:33:51Z

/cc @nodejs/crypto

danbev · 2017-05-26T06:34:26Z

CI: https://ci.nodejs.org/job/node-test-pull-request/8316/

danbev · 2017-05-26T08:01:54Z

test/osx failure looks unrelated

console output:

not ok 457 parallel/test-http-1.0-keep-alive
  ---
  duration_ms: 6.478
  severity: crashed
  stack: |-
    oh no!
    exit code: CRASHED (Signal: 9)
  ...
not ok 458 parallel/test-http-abort-before-end
  ---
  duration_ms: 6.475
  severity: crashed
  stack: |-
    oh no!
    exit code: CRASHED (Signal: 9)
  ...

shigeki · 2017-05-26T10:24:57Z

It seems asm files are not updated. Did you run https://github.com/nodejs/node/blob/master/deps/openssl/doc/UPGRADING.md#6-asm-files-for-openssl?

danbev · 2017-05-26T10:59:52Z

It seems asm files are not updated. Did you run

I actually did not run them, will do that now. For some reason I though there was no need to have them updated but looking closer I realise there are changes to them. About the versions of gcc and nasm, do these have to be exact matches or are later version also alright?

danbev · 2017-05-26T11:06:32Z

Regenerate asm files with Makefile and CC=gcc and ASM=gcc where gcc-4.8.4.

@shigeki Should the commit message be ASM=nasm here instead or is the above correct?

danbev · 2017-05-27T03:55:49Z

CI: https://ci.nodejs.org/job/node-test-pull-request/8327/

shigeki · 2017-05-29T11:40:02Z

Regenerate asm files with Makefile and CC=gcc and ASM=gcc where gcc-4.8.4.
@shigeki Should the commit message be ASM=nasm here instead or is the above correct?

@danbev ASM=nasm is the right one. I mistook the word in that commit message.
I checked the asm updates of 8561e192173b4df66f941c07a0cc0a4748eea1a9 and found that something wrong in checking nasm version with ASM env. Could you give me an output of nasm -v?

danbev · 2017-05-29T11:50:43Z

ASM=nasm is the right one. I mistook the word in that commit message.

Great, I used that in the commit message and also added the version of nasm being used. If you think this looks good I can update step 6.3.

Could you give me an output of nasm -v?

$ nasm -v
NASM version 2.11.06 compiled on Nov  4 2014

shigeki · 2017-05-29T12:21:32Z

@danbev Sorry, I should have ask you about your CC environment not ASM. It seems that your commit of updating asm files in 8561e192173b4df66f941c07a0cc0a4748eea1a9 failed to check the avx version of https://github.com/nodejs/node/blob/master/deps/openssl/openssl/crypto/aes/asm/aesni-mb-x86_64.pl#L51-L54. I requires that gas version above 2.22, which is $avx == 2 on Linux to regenerate asm files.

This is my output gas version.

$ $CC -Wa,-v -c -o /dev/null -x assembler /dev/null
GNU assembler version 2.26.1 (x86_64-linux-gnu) using BFD version (GNU Binutils for Ubuntu) 2.26.1

What is yours?

shigeki · 2017-05-29T12:38:38Z

@danbev shigeki@aaa09eb is my asm updates on upgrading 1.0.2l. If it have any difference with yours, there is something wrong between your env and mine.

danbev · 2017-05-29T12:44:44Z

What is yours?

$ $CC -Wa,-v -c -o /dev/null -x assembler /dev/null
Apple LLVM version 8.0.0 (clang-800.0.42.1)
Target: x86_64-apple-darwin15.6.0
Thread model: posix
InstalledDir: /Library/Developer/CommandLineTools/usr/bin
 "/Library/Developer/CommandLineTools/usr/bin/clang" -cc1as -triple x86_64-apple-macosx10.11.0 -filetype obj -main-file-name null -target-cpu core2 -fdebug-compilation-dir /Users/danielbevenius/work/nodejs/node/deps/openssl -dwarf-debug-producer Apple LLVM version 8.0.0 (clang-800.0.42.1) -dwarf-version=2 -mrelocation-model pic -o /dev/null /dev/null

My $CC version is:

$ $CC --version
gcc-4.8 (Homebrew gcc48 4.8.3) 4.8.3
Copyright (C) 2013 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Sorry if I misunderstood the docs, the example does show using linux but does this have to be done on Linux?

shigeki · 2017-05-29T12:51:36Z

I've got it. The upgrading doc is only for Linux. I tried to run on MacOS but it failed. I did not investigate it further. You can fix it to work it on MacOS or re-update it on Linux.

danbev · 2017-05-29T12:54:18Z

I've got it. The upgrading doc is only for Linux. I tried to run on MacOS but it failed. I did not investigate it further. You can fix it to work it on MacOS or re-update it on Linux.

I'll take a look and see if I can get this working on MacOS, otherwise I'll re-update it on Linux. Thanks

danbev · 2017-05-29T18:17:28Z

@shigeki I built this on Linux as I was not able to get it work properly on MacOS. Could you take a look, I'm a little concerned that I have a bunch or deletes in asm_obsolete that were not in your example commit. Did I miss something?

I was wondering about these steps:

ohtsu@ubuntu:~/github/node/deps/openssl/asm$ cd ../asm_obsolete/
ohtsu@ubuntu:~/github/node/deps/openssl/asm_obsolete$ unset CC
ohtsu@ubuntu:~/github/node/deps/openssl/asm_obsolete$ unset ASM
ohtsu@ubuntu:~/github/node/deps/openssl/asm_obsolete$ make clean
find . -iname '*.asm' -exec rm "{}" \;
find . -iname '*.s' -exec rm "{}" \;
find . -iname '*.S' -exec rm "{}" \;
ohtsu@ubuntu:~/github/node/deps/openssl$ git status

We do a make clean but it is not followed by a make, is that correct? I did not do a make as I'm following the doc but wanted to double check that I did not miss a command here. Thanks

shigeki · 2017-05-30T14:01:17Z

@danbev You are right. It was missed in the doc that

ohtsu@ubuntu:~/github/node/deps/openssl/asm_obsolete$ make

after make clean in order to generate asm files in case of no CC and ASM envs.

Could you update asm files in the asm_obsolete dir and also add the commit to fix UPGRADING.md?

danbev · 2017-05-30T17:35:00Z

Could you update asm files in the asm_obsolete dir and also add the commit to fix UPGRADING.md?

@shigeki I've updated now and also rebased, plus added an additional commit for UPGRADING.md. Let me know what you think, thanks!

danbev · 2017-05-30T17:35:53Z

Rebased CI: https://ci.nodejs.org/job/node-test-pull-request/8376/

shigeki

Everything is fine. Thanks for your work.
I will land this later to see if anyone puts another approvals.

danbev · 2017-05-31T15:20:07Z

@shigeki Thanks for your help and your patience on this!

mhdawson

Rubber stamp LGTM.

shigeki · 2017-06-01T13:37:01Z

@danbev I've just found one issue in this PR.
You added 12f61e94f8c396d1aeda73aaac65d2e10b954416 to reverted the floating patch but the revert fix was applied after replacing openssl sources so that it reverts original openssl source fix.
It is needed to revert the floating patch before replacing openssl sources or just leave it without reverting. I think the latter is simple. Please remove 12f61e94f8c396d1aeda73aaac65d2e10b954416.

This replaces all sources of openssl-1.0.2l.tar.gz into deps/openssl/openssl

All symlink files in deps/openssl/openssl/include/openssl/ are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h.

Regenerate asm files with Makefile and CC=gcc and ASM=nasm where gcc version was 5.4.0 and nasm version was 2.11.08. Also asm files in asm_obsolete dir to support old compiler and assembler are regenerated without CC and ASM envs. Fixes: #13161 PR-URL: #13233 Backport-PR-URL: #13695 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Added the missing make command in steps 6.3 when building asm_obsolete. Also updated the commit message to include the version nasm in addition to the gcc version. Fixes: #13161 PR-URL: #13233 Backport-PR-URL: #13695 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

This replaces all sources of openssl-1.0.2l.tar.gz into deps/openssl/openssl Fixes: #13161 PR-URL: #13233 Backport-PR-URL: #13695 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

All symlink files in deps/openssl/openssl/include/openssl/ are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Fixes: #13161 PR-URL: #13233 Backport-PR-URL: #13695 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Regenerate config files for supported platforms with Makefile. Fixes: #13161 PR-URL: #13233 Backport-PR-URL: #13695 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Regenerate asm files with Makefile and CC=gcc and ASM=nasm where gcc version was 5.4.0 and nasm version was 2.11.08. Also asm files in asm_obsolete dir to support old compiler and assembler are regenerated without CC and ASM envs. Fixes: #13161 PR-URL: #13233 Backport-PR-URL: #13695 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Added the missing make command in steps 6.3 when building asm_obsolete. Also updated the commit message to include the version nasm in addition to the gcc version. Fixes: #13161 PR-URL: #13233 Backport-PR-URL: #13695 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

This replaces all sources of openssl-1.0.2l.tar.gz into deps/openssl/openssl Fixes: #13161 Backport-PR-URL: #13696 PR-URL: #13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

All symlink files in deps/openssl/openssl/include/openssl/ are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Fixes: #13161 Backport-PR-URL: #13696 PR-URL: #13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Regenerate config files for supported platforms with Makefile. Fixes: #13161 Backport-PR-URL: #13696 PR-URL: #13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Regenerate asm files with Makefile and CC=gcc and ASM=nasm where gcc version was 5.4.0 and nasm version was 2.11.08. Also asm files in asm_obsolete dir to support old compiler and assembler are regenerated without CC and ASM envs. Fixes: #13161 Backport-PR-URL: #13696 PR-URL: #13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Added the missing make command in steps 6.3 when building asm_obsolete. Also updated the commit message to include the version nasm in addition to the gcc version. Fixes: #13161 Backport-PR-URL: #13696 PR-URL: #13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

This replaces all sources of openssl-1.0.2l.tar.gz into deps/openssl/openssl Fixes: #13161 Backport-PR-URL: #13696 PR-URL: #13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

All symlink files in deps/openssl/openssl/include/openssl/ are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Fixes: #13161 Backport-PR-URL: #13696 PR-URL: #13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Regenerate config files for supported platforms with Makefile. Fixes: #13161 Backport-PR-URL: #13696 PR-URL: #13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Regenerate asm files with Makefile and CC=gcc and ASM=nasm where gcc version was 5.4.0 and nasm version was 2.11.08. Also asm files in asm_obsolete dir to support old compiler and assembler are regenerated without CC and ASM envs. Fixes: #13161 Backport-PR-URL: #13696 PR-URL: #13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Added the missing make command in steps 6.3 when building asm_obsolete. Also updated the commit message to include the version nasm in addition to the gcc version. Fixes: #13161 Backport-PR-URL: #13696 PR-URL: #13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Notable Changes: * **crypto**: - update root certificates (Ben Noordhuis) #13279 - update root certificates (Ben Noordhuis) #12402 * **deps**: - add support for more modern versions of INTL (Bruno Pagani) #13040 - upgrade openssl sources to 1.0.2m (Shigeki Ohtsu) #16691 - upgrade openssl sources to 1.0.2l (Daniel Bevenius) #13233 PR-URL: #16500

This replaces all sources of openssl-1.0.2l.tar.gz into deps/openssl/openssl Fixes: nodejs/node#13161 PR-URL: nodejs/node#13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

All symlink files in deps/openssl/openssl/include/openssl/ are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Fixes: nodejs/node#13161 PR-URL: nodejs/node#13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Regenerate config files for supported platforms with Makefile. Fixes: nodejs/node#13161 PR-URL: nodejs/node#13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Regenerate asm files with Makefile and CC=gcc and ASM=nasm where gcc version was 5.4.0 and nasm version was 2.11.08. Also asm files in asm_obsolete dir to support old compiler and assembler are regenerated without CC and ASM envs. Fixes: nodejs/node#13161 PR-URL: nodejs/node#13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Added the missing make command in steps 6.3 when building asm_obsolete. Also updated the commit message to include the version nasm in addition to the gcc version. Fixes: nodejs/node#13161 PR-URL: nodejs/node#13233 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

nodejs-github-bot added the openssl Issues and PRs related to the OpenSSL dependency. label May 26, 2017

mscdex reviewed May 26, 2017

View reviewed changes

danbev force-pushed the openssl-1.0.2l branch from 076aca1 to 006b395 Compare May 30, 2017 17:32

shigeki approved these changes May 31, 2017

View reviewed changes

shigeki added lts-watch-v4.x labels May 31, 2017

sam-github approved these changes May 31, 2017

View reviewed changes

mhdawson approved these changes May 31, 2017

View reviewed changes

danbev added 2 commits June 1, 2017 13:42

deps: upgrade openssl sources to 1.0.2l

9287100

This replaces all sources of openssl-1.0.2l.tar.gz into deps/openssl/openssl

deps: copy all openssl header files to include dir

e237cb6

All symlink files in deps/openssl/openssl/include/openssl/ are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h.

MylesBorins mentioned this pull request Jul 18, 2017

v6.11.2 proposal #14356

Merged

MylesBorins mentioned this pull request Sep 20, 2017

v4.8.5 proposal #15507

Closed

MylesBorins mentioned this pull request Oct 25, 2017

v4.8.6 proposal #16500

Merged

abernix mentioned this pull request Nov 7, 2017

Release 1.5.4 meteor/meteor#9320

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

deps: upgrade OpenSSL to version 1.0.2l #13233

deps: upgrade OpenSSL to version 1.0.2l #13233

danbev commented May 26, 2017

mscdex May 26, 2017

danbev May 26, 2017

shigeki May 26, 2017

mscdex commented May 26, 2017

danbev commented May 26, 2017

danbev commented May 26, 2017

shigeki commented May 26, 2017

danbev commented May 26, 2017

danbev commented May 26, 2017

danbev commented May 27, 2017

shigeki commented May 29, 2017

danbev commented May 29, 2017

shigeki commented May 29, 2017

shigeki commented May 29, 2017

danbev commented May 29, 2017

shigeki commented May 29, 2017

danbev commented May 29, 2017

danbev commented May 29, 2017 •

edited

Loading

shigeki commented May 30, 2017

danbev commented May 30, 2017

danbev commented May 30, 2017

shigeki left a comment

danbev commented May 31, 2017

mhdawson left a comment

shigeki commented Jun 1, 2017

deps: upgrade OpenSSL to version 1.0.2l #13233

deps: upgrade OpenSSL to version 1.0.2l #13233

Conversation

danbev commented May 26, 2017

Checklist

Affected core subsystem(s)

mscdex May 26, 2017

Choose a reason for hiding this comment

danbev May 26, 2017

Choose a reason for hiding this comment

shigeki May 26, 2017

Choose a reason for hiding this comment

mscdex commented May 26, 2017

danbev commented May 26, 2017

danbev commented May 26, 2017

shigeki commented May 26, 2017

danbev commented May 26, 2017

danbev commented May 26, 2017

danbev commented May 27, 2017

shigeki commented May 29, 2017

danbev commented May 29, 2017

shigeki commented May 29, 2017

shigeki commented May 29, 2017

danbev commented May 29, 2017

shigeki commented May 29, 2017

danbev commented May 29, 2017

danbev commented May 29, 2017 • edited Loading

shigeki commented May 30, 2017

danbev commented May 30, 2017

danbev commented May 30, 2017

shigeki left a comment

Choose a reason for hiding this comment

danbev commented May 31, 2017

mhdawson left a comment

Choose a reason for hiding this comment

shigeki commented Jun 1, 2017

danbev commented May 29, 2017 •

edited

Loading