Skip to content

Commit

Permalink
gyp: build openssl-cli tool and use it in tests
Browse files Browse the repository at this point in the history 
fix nodejs#6663
  • Loading branch information
@indutny
indutny committed Dec 11, 2013
1 parent 153784b commit 6f3d603
Show file tree
Hide file tree
Showing 13 changed files with 182 additions and 119 deletions.
178 changes: 146 additions & 32 deletions deps/openssl/openssl.gyp
View file
Expand Up @@ -12,18 +12,6 @@
{
'target_name': 'openssl',
'type': '<(library)',
'defines': [
# No clue what these are for.
'L_ENDIAN',
'PURIFY',
'_REENTRANT',

# Heartbeat is a TLS extension, that couldn't be turned off or
# asked to be not advertised. Unfortunately this is unacceptable for
# Microsoft's IIS, which seems to be ignoring whole ClientHello after
# seeing this extension.
'OPENSSL_NO_HEARTBEATS',
],
'sources': [
'openssl/ssl/bio_ssl.c',
'openssl/ssl/d1_both.c',
Expand Down Expand Up @@ -935,32 +923,12 @@
]
}],
['OS=="win"', {
'defines': [
'MK1MF_BUILD',
'WIN32_LEAN_AND_MEAN'
],
'link_settings': {
'libraries': [
'-lgdi32.lib',
'-luser32.lib',
]
}
}, {
'defines': [
# ENGINESDIR must be defined if OPENSSLDIR is.
'ENGINESDIR="/dev/null"',
# Set to ubuntu default path for convenience. If necessary, override
# this at runtime with the SSL_CERT_DIR environment variable.
'OPENSSLDIR="/etc/ssl"',
'TERMIOS',
],
'cflags': ['-Wno-missing-field-initializers'],
}],
['is_clang==1 or gcc_version>=43', {
'cflags': ['-Wno-old-style-declaration'],
}],
['OS=="solaris"', {
'defines': ['__EXTENSIONS__'],
}],
['target_arch=="arm"', {
'sources': ['openssl/crypto/armcap.c'],
Expand All @@ -981,7 +949,153 @@
'include_dirs': ['openssl/include'],
},
},
{
'target_name': 'openssl-cli',
'type': 'executable',
'dependencies': [
'openssl',
],
'defines': [
'MONOLITH',
],
'sources': [
'openssl/apps/app_rand.c',
'openssl/apps/apps.c',
'openssl/apps/asn1pars.c',
'openssl/apps/ca.c',
'openssl/apps/ciphers.c',
'openssl/apps/cms.c',
'openssl/apps/crl.c',
'openssl/apps/crl2p7.c',
'openssl/apps/dgst.c',
'openssl/apps/dh.c',
'openssl/apps/dhparam.c',
'openssl/apps/dsa.c',
'openssl/apps/dsaparam.c',
'openssl/apps/ec.c',
'openssl/apps/ecparam.c',
'openssl/apps/enc.c',
'openssl/apps/engine.c',
'openssl/apps/errstr.c',
'openssl/apps/gendh.c',
'openssl/apps/gendsa.c',
'openssl/apps/genpkey.c',
'openssl/apps/genrsa.c',
'openssl/apps/nseq.c',
'openssl/apps/ocsp.c',
'openssl/apps/openssl.c',
'openssl/apps/passwd.c',
'openssl/apps/pkcs12.c',
'openssl/apps/pkcs7.c',
'openssl/apps/pkcs8.c',
'openssl/apps/pkey.c',
'openssl/apps/pkeyparam.c',
'openssl/apps/pkeyutl.c',
'openssl/apps/prime.c',
'openssl/apps/rand.c',
'openssl/apps/req.c',
'openssl/apps/rsa.c',
'openssl/apps/rsautl.c',
'openssl/apps/s_cb.c',
'openssl/apps/s_client.c',
'openssl/apps/s_server.c',
'openssl/apps/s_socket.c',
'openssl/apps/s_time.c',
'openssl/apps/sess_id.c',
'openssl/apps/smime.c',
'openssl/apps/speed.c',
'openssl/apps/spkac.c',
'openssl/apps/srp.c',
'openssl/apps/ts.c',
'openssl/apps/verify.c',
'openssl/apps/version.c',
'openssl/apps/x509.c',
],
'conditions': [
['OS=="solaris"', {
'libraries': [
'-lsocket',
'-lnsl',
]
}],
['OS=="win"', {
'link_settings': {
'libraries': [
'-lws2_32.lib',
'-lgdi32.lib',
'-ladvapi32.lib',
'-lcrypt32.lib',
'-luser32.lib',
],
},
}]
]
}
],
'target_defaults': {
'include_dirs': [
'.',
'openssl',
'openssl/crypto',
'openssl/crypto/asn1',
'openssl/crypto/evp',
'openssl/crypto/md2',
'openssl/crypto/modes',
'openssl/crypto/store',
'openssl/include',
],
'defines': [
# No clue what these are for.
'L_ENDIAN',
'PURIFY',
'_REENTRANT',

# Heartbeat is a TLS extension, that couldn't be turned off or
# asked to be not advertised. Unfortunately this is unacceptable for
# Microsoft's IIS, which seems to be ignoring whole ClientHello after
# seeing this extension.
'OPENSSL_NO_HEARTBEATS',
],
'conditions': [
['OS=="win"', {
'defines': [
'MK1MF_BUILD',
'WIN32_LEAN_AND_MEAN',
'OPENSSL_SYSNAME_WIN32',
],
}, {
'defines': [
# ENGINESDIR must be defined if OPENSSLDIR is.
'ENGINESDIR="/dev/null"',
'TERMIOS',
],
'cflags': ['-Wno-missing-field-initializers'],
'conditions': [
['OS=="mac"', {
'defines': [
# Set to ubuntu default path for convenience. If necessary,
# override this at runtime with the SSL_CERT_DIR environment
# variable.
'OPENSSLDIR="/System/Library/OpenSSL/"',
],
}, {
'defines': [
# Set to ubuntu default path for convenience. If necessary,
# override this at runtime with the SSL_CERT_DIR environment
# variable.
'OPENSSLDIR="/etc/ssl"',
],
}],
]
}],
['is_clang==1 or gcc_version>=43', {
'cflags': ['-Wno-old-style-declaration'],
}],
['OS=="solaris"', {
'defines': ['__EXTENSIONS__'],
}],
],
},
}

# Local Variables:
Expand Down
7 changes: 6 additions & 1 deletion node.gyp
View file
Expand Up @@ -177,7 +177,12 @@
],
'conditions': [
[ 'node_shared_openssl=="false"', {
'dependencies': [ './deps/openssl/openssl.gyp:openssl' ],
'dependencies': [
'./deps/openssl/openssl.gyp:openssl',

# For tests
'./deps/openssl/openssl.gyp:openssl-cli'
],
}]]
}, {
'defines': [ 'HAVE_OPENSSL=0' ]
Expand Down
2 changes: 2 additions & 0 deletions test/common.js
View file
Expand Up @@ -30,8 +30,10 @@ exports.PORT = +process.env.NODE_COMMON_PORT || 12346;

if (process.platform === 'win32') {
exports.PIPE = '\\\\.\\pipe\\libuv-test';
exports.opensslCli = path.join(process.execPath, '..', 'openssl-cli.exe');
} else {
exports.PIPE = exports.tmpDir + '/test.sock';
exports.opensslCli = path.join(process.execPath, '..', 'openssl-cli');
}

var util = require('util');
Expand Down
7 changes: 1 addition & 6 deletions test/pummel/test-https-ci-reneg-attack.js
View file
Expand Up @@ -29,11 +29,6 @@ var fs = require('fs');
// renegotiation limits to test
var LIMITS = [0, 1, 2, 3, 5, 10, 16];

if (process.platform === 'win32') {
console.log('Skipping test, you probably don\'t have openssl installed.');
process.exit();
}

(function() {
var n = 0;
function next() {
Expand Down Expand Up @@ -65,7 +60,7 @@ function test(next) {

server.listen(common.PORT, function() {
var args = ('s_client -connect 127.0.0.1:' + common.PORT).split(' ');
var child = spawn('openssl', args);
var child = spawn(common.opensslCli, args);

child.stdout.pipe(process.stdout);
child.stderr.pipe(process.stderr);
Expand Down
7 changes: 1 addition & 6 deletions test/pummel/test-tls-ci-reneg-attack.js
View file
Expand Up @@ -28,11 +28,6 @@ var fs = require('fs');
// renegotiation limits to test
var LIMITS = [0, 1, 2, 3, 5, 10, 16];

if (process.platform === 'win32') {
console.log('Skipping test, you probably don\'t have openssl installed.');
process.exit();
}

(function() {
var n = 0;
function next() {
Expand Down Expand Up @@ -63,7 +58,7 @@ function test(next) {

server.listen(common.PORT, function() {
var args = ('s_client -connect 127.0.0.1:' + common.PORT).split(' ');
var child = spawn('openssl', args);
var child = spawn(common.opensslCli, args);

child.stdout.pipe(process.stdout);
child.stderr.pipe(process.stderr);
Expand Down
24 changes: 5 additions & 19 deletions test/pummel/test-tls-securepair-client.js
View file
Expand Up @@ -34,21 +34,7 @@ var tls = require('tls');
var exec = require('child_process').exec;
var spawn = require('child_process').spawn;

maybe(test1);

// There is a bug with 'openssl s_server' which makes it not flush certain
// important events to stdout when done over a pipe. Therefore we skip this
// test for all openssl versions less than 1.0.0.
function maybe(cb) {
exec('openssl version', function(err, data) {
if (err) throw err;
if (/OpenSSL 0\./.test(data)) {
console.error('Skipping due to old OpenSSL version.');
return;
}
cb();
});
}
test1();

// simple/test-tls-securepair-client
function test1() {
Expand Down Expand Up @@ -81,10 +67,10 @@ function test(keyfn, certfn, check, next) {
certfn = join(common.fixturesDir, certfn);
var cert = fs.readFileSync(certfn).toString();

var server = spawn('openssl', ['s_server',
'-accept', PORT,
'-cert', certfn,
'-key', keyfn]);
var server = spawn(common.opensslCli, ['s_server',
'-accept', PORT,
'-cert', certfn,
'-key', keyfn]);
server.stdout.pipe(process.stdout);
server.stderr.pipe(process.stdout);

Expand Down
10 changes: 2 additions & 8 deletions test/pummel/test-tls-session-timeout.js
View file
Expand Up @@ -23,13 +23,7 @@ if (!process.versions.openssl) {
console.error('Skipping because node compiled without OpenSSL.');
process.exit(0);
}
require('child_process').exec('openssl version', function(err) {
if (err !== null) {
console.error('Skipping because openssl command is not available.');
process.exit(0);
}
doTest();
});
doTest();

// This test consists of three TLS requests --
// * The first one should result in a new connection because we don't have
Expand Down Expand Up @@ -83,7 +77,7 @@ function doTest() {
'-sess_in', sessionFileName,
'-sess_out', sessionFileName
];
var client = spawn('openssl', flags, {
var client = spawn(common.opensslCli, flags, {
stdio: ['ignore', 'pipe', 'ignore']
});

Expand Down
7 changes: 1 addition & 6 deletions test/simple/test-tls-ecdh-disable.js
View file
Expand Up @@ -25,11 +25,6 @@ var exec = require('child_process').exec;
var tls = require('tls');
var fs = require('fs');

if (process.platform === 'win32') {
console.log("Skipping test, you probably don't have openssl installed.");
process.exit();
}

var options = {
key: fs.readFileSync(common.fixturesDir + '/keys/agent2-key.pem'),
cert: fs.readFileSync(common.fixturesDir + '/keys/agent2-cert.pem'),
Expand All @@ -49,7 +44,7 @@ var server = tls.createServer(options, function(conn) {
});

server.listen(common.PORT, '127.0.0.1', function() {
var cmd = 'openssl s_client -cipher ' + options.ciphers +
var cmd = common.opensslCli + ' s_client -cipher ' + options.ciphers +
' -connect 127.0.0.1:' + common.PORT;

exec(cmd, function(err, stdout, stderr) {
Expand Down
7 changes: 1 addition & 6 deletions test/simple/test-tls-ecdh.js
View file
Expand Up @@ -25,11 +25,6 @@ var exec = require('child_process').exec;
var tls = require('tls');
var fs = require('fs');

if (process.platform === 'win32') {
console.log("Skipping test, you probably don't have openssl installed.");
process.exit();
}

var options = {
key: fs.readFileSync(common.fixturesDir + '/keys/agent2-key.pem'),
cert: fs.readFileSync(common.fixturesDir + '/keys/agent2-cert.pem'),
Expand All @@ -52,7 +47,7 @@ var server = tls.createServer(options, function(conn) {
});

server.listen(common.PORT, '127.0.0.1', function() {
var cmd = 'openssl s_client -cipher ' + options.ciphers +
var cmd = common.opensslCli + ' s_client -cipher ' + options.ciphers +
' -connect 127.0.0.1:' + common.PORT;

exec(cmd, function(err, stdout, stderr) {
Expand Down
2 changes: 1 addition & 1 deletion test/simple/test-tls-securepair-server.js
View file
Expand Up @@ -115,7 +115,7 @@ var opensslExitCode = -1;

server.listen(common.PORT, function() {
// To test use: openssl s_client -connect localhost:8000
var client = spawn('openssl', ['s_client', '-connect', '127.0.0.1:' +
var client = spawn(common.opensslCli, ['s_client', '-connect', '127.0.0.1:' +
common.PORT]);


Expand Down
2 changes: 1 addition & 1 deletion test/simple/test-tls-server-verify.js
View file
Expand Up @@ -198,7 +198,7 @@ function runClient(options, cb) {
}

// To test use: openssl s_client -connect localhost:8000
var client = spawn('openssl', args);
var client = spawn(common.opensslCli, args);

var out = '';

Expand Down

0 comments on commit 6f3d603

Please sign in to comment.