[v10.x backport] Update openssl1.1.1a #26270

sam-github · 2019-02-23T00:17:04Z

Backport openssl 1.1.1a related PRs. They depend on each other, so I am including in one PR:

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
documentation is changed or added
commit message follows commit guidelines

nodejs-github-bot · 2019-02-23T00:17:08Z

@sam-github sadly an error occured when I tried to trigger a build :(

sam-github · 2019-02-23T00:29:11Z

re: #24979 (comment)

@nodejs/lts @MylesBorins @BethGriggs Please make sure this makes its way into the upcoming 10.x semver-minor release.

sam-github · 2019-02-28T16:12:53Z

ci: https://ci.nodejs.org/job/node-test-pull-request/21041/

The existing secureProtocol option only allows setting the allowed protocol to a specific version, or setting it to "all supported versions". It also used obscure strings based on OpenSSL C API functions. Directly setting the min or max is easier to use and explain. Backport-PR-URL: nodejs#24676 PR-URL: nodejs#24405 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org>

Fill in correct pr-url: value in the YAML changelog that was missing from f512f5e. The stanza was also sorted in the wrong order, most recent is supposed to be in the beginning of the changes, not the end. PR-URL: nodejs#24759 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

This updates all sources in deps/openssl/openssl with openssl-1.1.1a. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

Some of defines and cppflags in the build config of OpenSSL-1.1.1 were moved to new attributes. Gyp and gypi file generations are needed to be fixed to include them. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

Because llvm on MacOS does not support AVX-512, asm files need to be limited to AVX-2 support even when they are generated on Linux. fake_gcc.pl returns the fake llvm banner version for MacOS as if the assembler supports upto AVX-2. For Windows, makefiles for nmake were updated in OpenSSL-1.1.1 and they are rewritten into GNU makefile format by hand. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

This is a floating patch against OpenSSL-1.1.1 to generate asm files with Makefile rules. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

OpenSSL-1.1.1 has new support of AVX-512 but AVX-2 asm files still need to be generated for the older assembler support to keep backward compatibilities. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

AIX has own assembler not GNU as that does not support --noexecstack. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

Add new requirements of assembler version for AVX-512 support in OpenSSL-1.1.1. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

`cd deps/openssl/config; make` updates all archs dependant files. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

`SSL_CB_HANDSHAKE_START` and `SSL_CB_HANDSHAKE_DONE` are called sending HelloRequest in OpenSSL-1.1.1. We need to check whether this is in a renegotiation state or not. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

This gets better coverage of the codes, and is more explicit. It also works around ordering differences in the errors produced by openssl. The approach was tested with 1.1.0 and 1.1.1, as well as TLSv1.2 vs TLSv1.3. OpenSSL 1.1.0 is relevant when node is built against a shared openssl. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

sam-github · 2019-02-28T21:34:43Z

ci: https://ci.nodejs.org/job/node-test-pull-request/21064/

sam-github · 2019-03-01T16:16:15Z

re-ci: https://ci.nodejs.org/job/node-test-pull-request/21099/

the few failures look like the flaky builds, so trying to resume.

sam-github · 2019-03-02T02:21:32Z

ci: https://ci.nodejs.org/job/node-test-pull-request/21111/ ✅

mhdawson · 2019-03-14T14:56:38Z

@sam-github did the backports land cleanly or where there things up needed to adjust?

sam-github · 2019-03-14T15:51:23Z

@BethGriggs tls: add min/max had minor textual conflicts, because 3b4159c is on master and not on 10.x, so I had to do some minor textual fixups there. Compare git show f512f5ea138 and git show be6a3a1, you don't have to be a TLS expert. The rest of the changes just cherry-picked clean, IIRC. Maybe I should have done a seperate PR for each backport, but since they are cumulative (EDIT: dependant), I would have had to do it sequentially, and they would have had to be reviewed and merged to v10.x staging before I could do the next. It didn't occur to me this would need re-review.

@nodejs/crypto PTAL

nodejs-github-bot · 2019-03-28T16:12:12Z

CI: https://ci.nodejs.org/job/node-test-pull-request/21989/

The existing secureProtocol option only allows setting the allowed protocol to a specific version, or setting it to "all supported versions". It also used obscure strings based on OpenSSL C API functions. Directly setting the min or max is easier to use and explain. Backport-PR-URL: #26270 PR-URL: #24405 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org>

Fill in correct pr-url: value in the YAML changelog that was missing from f512f5e. The stanza was also sorted in the wrong order, most recent is supposed to be in the beginning of the changes, not the end. Backport-PR-URL: #26270 PR-URL: #24759 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

This updates all sources in deps/openssl/openssl with openssl-1.1.1a. Backport-PR-URL: #26270 PR-URL: #25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

This is a floating patch against OpenSSL-1.1.1 to generate asm files with Makefile rules. Backport-PR-URL: #26270 PR-URL: #25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

Some of defines and cppflags in the build config of OpenSSL-1.1.1 were moved to new attributes. Gyp and gypi file generations are needed to be fixed to include them. Backport-PR-URL: #26270 PR-URL: #25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

Because llvm on MacOS does not support AVX-512, asm files need to be limited to AVX-2 support even when they are generated on Linux. fake_gcc.pl returns the fake llvm banner version for MacOS as if the assembler supports upto AVX-2. For Windows, makefiles for nmake were updated in OpenSSL-1.1.1 and they are rewritten into GNU makefile format by hand. Backport-PR-URL: #26270 PR-URL: #25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

OpenSSL-1.1.1 has new support of AVX-512 but AVX-2 asm files still need to be generated for the older assembler support to keep backward compatibilities. Backport-PR-URL: #26270 PR-URL: #25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

Add new requirements of assembler version for AVX-512 support in OpenSSL-1.1.1. Backport-PR-URL: #26270 PR-URL: #25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

AIX has own assembler not GNU as that does not support --noexecstack. Backport-PR-URL: #26270 PR-URL: #25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

`SSL_CB_HANDSHAKE_START` and `SSL_CB_HANDSHAKE_DONE` are called sending HelloRequest in OpenSSL-1.1.1. We need to check whether this is in a renegotiation state or not. Backport-PR-URL: #26270 PR-URL: #25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

This gets better coverage of the codes, and is more explicit. It also works around ordering differences in the errors produced by openssl. The approach was tested with 1.1.0 and 1.1.1, as well as TLSv1.2 vs TLSv1.3. OpenSSL 1.1.0 is relevant when node is built against a shared openssl. Backport-PR-URL: #26270 PR-URL: #25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

`cd deps/openssl/config; make` updates all archs dependant files. Backport-PR-URL: #26270 PR-URL: #25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

BethGriggs · 2019-03-28T20:55:08Z

Landed on v10.x-staging (a92286d...b0b73fa)

Ported from OpenSUSE:nodejs8-8.17.0-lp152.147.1:openssl_1_1_1.patch Original commit message: Backport OpenSSL 1.1.1 support, mostly be disabling TLS 1.3 Upstream commits: commit 8dd8033 Author: Shigeki Ohtsu <ohtsu@ohtsu.org> Date: Wed Sep 12 17:34:24 2018 +0900 tls: workaround handshakedone in renegotiation `SSL_CB_HANDSHAKE_START` and `SSL_CB_HANDSHAKE_DONE` are called sending HelloRequest in OpenSSL-1.1.1. We need to check whether this is in a renegotiation state or not. Backport-PR-URL: nodejs#26270 PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> commit 161dca7 Author: Sam Roberts <vieuxtech@gmail.com> Date: Wed Nov 28 14:11:18 2018 -0800 tls: re-define max supported version as 1.2 Several secureProtocol strings allow any supported TLS version as the maximum, but our maximum supported protocol version is TLSv1.2 even if someone configures a build against an OpenSSL that supports TLSv1.3. Fixes: nodejs#24658 PR-URL: nodejs#25024 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Partial port, remain compatible with 1.0.2: commit 970ce14 Author: Shigeki Ohtsu <ohtsu@ohtsu.org> Date: Wed Mar 14 14:26:55 2018 +0900 crypto: remove deperecated methods of TLS version All version-specific methods were deprecated in OpenSSL 1.1.0 and min/max versions explicitly need to be set. This still keeps comptatible with JS and OpenSSL-1.0.2 APIs for now. crypto, constants: add constant of OpenSSL-1.1.0 Several constants for OpenSSL-1.1.0 engine were removed and renamed in OpenSSL-1.1.0. This added one renamed constant in order to have a compatible feature with that of OpenSSL-1.0.2. Other missed or new constants in OpenSSL-1.1.0 are not yet added. crypto,tls,constants: remove OpenSSL1.0.2 support This is semver-majar change so that we need not to have compatibilities with older versions. Fixes: nodejs#4270 PR-URL: nodejs#19794 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Signed-off-by: Su Baocheng <baocheng.su@siemens.com>

nodejs-github-bot added build Issues and PRs related to build files or the CI. doc Issues and PRs related to the documentations. openssl Issues and PRs related to the OpenSSL dependency. v10.x labels Feb 23, 2019

sam-github mentioned this pull request Feb 23, 2019

[v10.x backport] tls: add min/max protocol version options #24979

Closed

4 tasks

sam-github force-pushed the update_openssl1.1.1a-v10.x branch from 6d2c6f5 to a17cd51 Compare February 23, 2019 00:51

mscdex mentioned this pull request Feb 26, 2019

crypto: fix EdDSA support for KeyObject #26319

Merged

3 tasks

sam-github mentioned this pull request Feb 27, 2019

OpenSSL 1.1.1 Support TODO (pls help) #18770

Closed

rvagg force-pushed the v10.x-staging branch from 5711238 to 156e4c8 Compare February 28, 2019 12:38

sam-github and others added 12 commits February 28, 2019 13:33

deps: upgrade openssl sources to 1.1.1a

39d09ce

This updates all sources in deps/openssl/openssl with openssl-1.1.1a. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

deps: add s390 asm rules for OpenSSL-1.1.1

08cf226

This is a floating patch against OpenSSL-1.1.1 to generate asm files with Makefile rules. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

deps: fix for non GNU assembler in AIX

87ff9f7

AIX has own assembler not GNU as that does not support --noexecstack. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

doc: fix assembler requirement for OpenSSL-1.1.1

eb3470a

Add new requirements of assembler version for AVX-512 support in OpenSSL-1.1.1. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

deps: update archs files for OpenSSL-1.1.1a

312dcc3

`cd deps/openssl/config; make` updates all archs dependant files. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Backport-PR-URL: nodejs#25688

sam-github force-pushed the update_openssl1.1.1a-v10.x branch from a17cd51 to d502073 Compare February 28, 2019 21:33

sam-github mentioned this pull request Mar 1, 2019

Update openssl1.1.1b #26327

Closed

2 tasks

sam-github mentioned this pull request Mar 7, 2019

jenkins: openssl1.1.0 not supported on node.js 12+ nodejs/build#1711

Merged

BethGriggs approved these changes Mar 15, 2019

View reviewed changes

sam-github mentioned this pull request Mar 26, 2019

doc: describe OpenSSL maintenance strategy nodejs/TSC#677

Merged

BethGriggs closed this Mar 28, 2019

sam-github deleted the update_openssl1.1.1a-v10.x branch March 29, 2019 18:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[v10.x backport] Update openssl1.1.1a #26270

[v10.x backport] Update openssl1.1.1a #26270

sam-github commented Feb 23, 2019 •

edited

Loading

nodejs-github-bot commented Feb 23, 2019

sam-github commented Feb 23, 2019

sam-github commented Feb 28, 2019

sam-github commented Feb 28, 2019

sam-github commented Mar 1, 2019

sam-github commented Mar 2, 2019 •

edited by BethGriggs

Loading

mhdawson commented Mar 14, 2019

sam-github commented Mar 14, 2019 •

edited

Loading

nodejs-github-bot commented Mar 28, 2019

BethGriggs commented Mar 28, 2019

[v10.x backport] Update openssl1.1.1a #26270

[v10.x backport] Update openssl1.1.1a #26270

Conversation

sam-github commented Feb 23, 2019 • edited Loading

Checklist

nodejs-github-bot commented Feb 23, 2019

sam-github commented Feb 23, 2019

sam-github commented Feb 28, 2019

sam-github commented Feb 28, 2019

sam-github commented Mar 1, 2019

sam-github commented Mar 2, 2019 • edited by BethGriggs Loading

mhdawson commented Mar 14, 2019

sam-github commented Mar 14, 2019 • edited Loading

nodejs-github-bot commented Mar 28, 2019

BethGriggs commented Mar 28, 2019

sam-github commented Feb 23, 2019 •

edited

Loading

sam-github commented Mar 2, 2019 •

edited by BethGriggs

Loading

sam-github commented Mar 14, 2019 •

edited

Loading