★ wanayoo — archive 1999 https://github.com/nodejs/node/pull/25381Nouvelle recherche | Portail wanayoo
Skip to content

/node

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update to openssl1.1.1a #25381

Closed
wants to merge 11 commits into from
+1,709,211 −164,261

Conversation

Reviewers

@danbev danbev

@shigeki shigeki

Assignees
No one assigned
Labels
backported-to-v10.x backported-to-v11.x build doc openssl semver-minor
Projects
  
Backported in v11.x
Milestone
No milestone
7 participants
@sam-github @nodejs-github-bot @shigeki @Trott @joyeecheung @targos @danbev
@sam-github
Copy link
Member

commented Jan 7, 2019 •
edited

Most of this work comes from @shigeki, who got openssl 1.1.1 building and running across all Node's platforms.

Last time I tested this branch on ci it passed, and it passes locally.

I've done a fair amount of ABI testing, as well. It looks pretty compatible to me (as OpenSSL intended).

See #18770 (comment) (and around) for more information.

@nodejs/crypto , particularly @rvagg @shigeki

Checklist
  • make -j4 test (UNIX), or vcbuild test (Windows) passes
  • tests and/or benchmarks are included
  • documentation is changed or added
  • commit message follows commit guidelines
@nodejs-github-bot

@nodejs-github-bot nodejs-github-bot added build doc openssl labels Jan 7, 2019

@sam-github sam-github referenced this pull request Jan 7, 2019

Closed

OpenSSL 1.1.1 Support TODO (pls help) #18770

@shigeki

This comment has been minimized.

Sign in to view
Copy link
Contributor

commented Jan 8, 2019

@sam-github Thanks for the PR. I could not imagine we can fix an async cipher error and that's a great work. For I'm in a business trip during this week, I'm going to take a detail look at this in later.
@danbev

danbev approved these changes Jan 8, 2019
View changes

@sam-github

This comment has been minimized.

Sign in to view
Copy link
Member Author

commented Jan 8, 2019

@shigeki Enjoy your trip, I'll make sure you have time to review.

ci: https://ci.nodejs.org/job/node-test-commit-linux-containered/9865/

Build and test against openssl 1.1.0 was the failure above. I'll look into it.

@sam-github sam-github force-pushed the sam-github:update_openssl1.1.1a branch from 8f1b9bd to e70a5e1 Jan 10, 2019

@sam-github

This comment has been minimized.

Sign in to view
Copy link
Member Author

commented Jan 15, 2019

The last build passed on everything except ARM.

re-ci: https://ci.nodejs.org/job/node-test-commit/25052/

This was referenced Jan 16, 2019

Closed
Open

danbev added a commit to danbev/node that referenced this pull request Jan 16, 2019

@danbev
test: change ciphers from 'RC4' to 'missing' 
This commit updates option ciphers from 'RC4' to 'missing' in
test/parallel/test-tls-handshake-error.js.

The motivation for this change is that this test is verifying that a
'no ciphers match' error be thrown, but 'RC4' might be among the ciphers
supported by the OpenSSL version when dynamically linking. I ran into
this specific issue when dynamically linking against OpenSSL 1.1.1 on
RHEL8 using nodejs#25381.
a01a6f8

@danbev danbev referenced this pull request Jan 16, 2019

Closed

test: change ciphers from 'RC4' to 'no-such-cipher' #25534

2 of 2 tasks complete
@sam-github

This comment has been minimized.

Sign in to view
Copy link
Member Author

commented Jan 17, 2019

So, been more than a week, green in CI, one approval, I guess I could just land this... but it is a significant enough update I'd like a few more reviews! @nodejs/crypto @shigeki @rvagg @bnoordhuis @indutny

1.1.1 adds some crypto algs and minor features (like zero-length PKCS8 passphrases, @tniessen ), so I'm labelling semver-minor.

@sam-github sam-github force-pushed the sam-github:update_openssl1.1.1a branch from d4bfbfb to fda3b55 Jan 17, 2019

@sam-github

This comment has been minimized.

Sign in to view
Copy link
Member Author

commented Jan 17, 2019

Updated against node/master, squashed fixups, started a fresh CI.

ci: https://ci.nodejs.org/job/node-test-pull-request/20184/

@sam-github sam-github added the semver-minor label Jan 17, 2019

@themarkymark-steem themarkymark-steem referenced this pull request Jan 19, 2019

Closed

ed25519 keys not working #352

danbev added a commit that referenced this pull request Jan 21, 2019

@danbev
test: change ciphers from RC4 to no-such-cipher 
This commit updates option ciphers from 'RC4' to 'no-such-cipher' in
test/parallel/test-tls-handshake-error.js.

The motivation for this change is that this test is verifying that a
'no ciphers match' error be thrown, but 'RC4' might be among the ciphers
supported by the OpenSSL version when dynamically linking. I ran into
this specific issue when dynamically linking against OpenSSL 1.1.1 on
RHEL8 using #25381.

PR-URL: #25534
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Loading status checks…
07e0c4e
@shigeki

shigeki approved these changes Jan 21, 2019
View changes

Copy link
Contributor

left a comment

@sam-github Sorry for my late response. I checked your and my change commits and they are fine but some of my commits are missing commit descriptions.

I made a branch to fill the commit descriptions in https://github.com/shigeki/node/commits/PR25381.
Please rebase this to add the commit descriptions from 8e05aa0, fd5d8cb, 0dd90f3 and 01fcc96.
fd5d8cb is also fixed so as to fix within 50 chars for commit title.

Thanks for making this PR.
@sam-github

This comment has been minimized.

Sign in to view
Copy link
Member Author

commented Jan 21, 2019

@shigeki Thanks for reviewing, I'll go through and rebase and fixup the messages.

@sam-github sam-github force-pushed the sam-github:update_openssl1.1.1a branch from fda3b55 to 572326a Jan 21, 2019

@sam-github

This comment has been minimized.

Sign in to view
Copy link
Member Author

commented Jan 21, 2019

Added commit bodies from @shigeki, rebased, re-ci.

ci: https://ci.nodejs.org/job/node-test-pull-request/20248/
@sam-github

This comment has been minimized.

Sign in to view
Copy link
Member Author

commented Jan 22, 2019

git node land claims commits were pushed after last CI, which I don't think is true, but re-running just in case.

ci: https://ci.nodejs.org/job/node-test-pull-request/20261/

shigeki and others added some commits Mar 7, 2018

@shigeki @sam-github
deps: add s390 asm rules for OpenSSL-1.1.1 
This is a floating patch against OpenSSL-1.1.1 to generate asm files
with Makefile rules.
4e75c01
@shigeki @sam-github
deps: fix gyp/gypi for openssl-1.1.1 
Some of defines and cppflags in the build config of OpenSSL-1.1.1 were
moved to new attributes. Gyp and gypi file generations are needed to be
fixed to include them.
00a24e1
@shigeki @sam-github
deps: fix MacOS and Win build for OpenSSL-1.1.1 
Because llvm on MacOS does not support AVX-512, asm files need to be limited to
AVX-2 support even when they are generated on Linux.  fake_gcc.pl returns the
fake llvm banner version for MacOS as if the assembler supports upto AVX-2.

For Windows, makefiles for nmake were updated in OpenSSL-1.1.1 and they are
rewritten into GNU makefile format by hand.
d813ce9
@shigeki @sam-github
deps: add only avx2 configs for OpenSSL-1.1.1 
OpenSSL-1.1.1 has new support of AVX-512 but AVX-2 asm files still need
to be generated for the older assembler support to keep backward
compatibilities.
7c0b4df
@sam-github
deps: upgrade openssl sources to 1.1.1a 
This updates all sources in deps/openssl/openssl with openssl-1.1.1a.
d0151fd

sam-github added a commit to sam-github/node that referenced this pull request Feb 28, 2019

@sam-github
deps: upgrade openssl sources to 1.1.1a 
This updates all sources in deps/openssl/openssl with openssl-1.1.1a.

PR-URL: nodejs#25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Backport-PR-URL: nodejs#25688
39d09ce

sam-github added a commit to sam-github/node that referenced this pull request Feb 28, 2019

@shigeki @sam-github
deps: fix gyp/gypi for openssl-1.1.1 
Some of defines and cppflags in the build config of OpenSSL-1.1.1 were
moved to new attributes. Gyp and gypi file generations are needed to be
fixed to include them.

PR-URL: nodejs#25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Backport-PR-URL: nodejs#25688
e8b39cf

sam-github added a commit to sam-github/node that referenced this pull request Feb 28, 2019

@shigeki @sam-github
deps: fix MacOS and Win build for OpenSSL-1.1.1 
Because llvm on MacOS does not support AVX-512, asm files need to be limited to
AVX-2 support even when they are generated on Linux.  fake_gcc.pl returns the
fake llvm banner version for MacOS as if the assembler supports upto AVX-2.

For Windows, makefiles for nmake were updated in OpenSSL-1.1.1 and they are
rewritten into GNU makefile format by hand.

PR-URL: nodejs#25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Backport-PR-URL: nodejs#25688
af05709

sam-github added a commit to sam-github/node that referenced this pull request Feb 28, 2019

@shigeki @sam-github
deps: add s390 asm rules for OpenSSL-1.1.1 
This is a floating patch against OpenSSL-1.1.1 to generate asm files
with Makefile rules.

PR-URL: nodejs#25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Backport-PR-URL: nodejs#25688
08cf226

sam-github added a commit to sam-github/node that referenced this pull request Feb 28, 2019

@shigeki @sam-github
deps: add only avx2 configs for OpenSSL-1.1.1 
OpenSSL-1.1.1 has new support of AVX-512 but AVX-2 asm files still need
to be generated for the older assembler support to keep backward
compatibilities.

PR-URL: nodejs#25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Backport-PR-URL: nodejs#25688
0cf96fb

sam-github added a commit to sam-github/node that referenced this pull request Feb 28, 2019

@shigeki @sam-github
deps: fix for non GNU assembler in AIX 
AIX has own assembler not GNU as that does not support --noexecstack.

PR-URL: nodejs#25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Backport-PR-URL: nodejs#25688
87ff9f7

sam-github added a commit to sam-github/node that referenced this pull request Feb 28, 2019

@shigeki @sam-github
doc: fix assembler requirement for OpenSSL-1.1.1 
Add new requirements of assembler version for AVX-512 support
in OpenSSL-1.1.1.

PR-URL: nodejs#25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Backport-PR-URL: nodejs#25688
eb3470a

sam-github added a commit to sam-github/node that referenced this pull request Feb 28, 2019

@sam-github
deps: update archs files for OpenSSL-1.1.1a 
`cd deps/openssl/config; make` updates all archs dependant files.

PR-URL: nodejs#25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Backport-PR-URL: nodejs#25688
312dcc3

sam-github added a commit to sam-github/node that referenced this pull request Feb 28, 2019

@shigeki @sam-github
tls: workaround handshakedone in renegotiation 
`SSL_CB_HANDSHAKE_START` and `SSL_CB_HANDSHAKE_DONE` are called
sending HelloRequest in OpenSSL-1.1.1.
We need to check whether this is in a renegotiation state or not.

PR-URL: nodejs#25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Backport-PR-URL: nodejs#25688
6be596d

sam-github added a commit to sam-github/node that referenced this pull request Feb 28, 2019

@sam-github
test: assert on client and server side seperately 
This gets better coverage of the codes, and is more explicit. It also
works around ordering differences in the errors produced by openssl.
The approach was tested with 1.1.0 and 1.1.1, as well as TLSv1.2 vs
TLSv1.3. OpenSSL 1.1.0 is relevant when node is built against a shared
openssl.

PR-URL: nodejs#25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Backport-PR-URL: nodejs#25688
d502073

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@sam-github @BethGriggs
deps: upgrade openssl sources to 1.1.1a 
This updates all sources in deps/openssl/openssl with openssl-1.1.1a.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
2d396fe

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
deps: fix gyp/gypi for openssl-1.1.1 
Some of defines and cppflags in the build config of OpenSSL-1.1.1 were
moved to new attributes. Gyp and gypi file generations are needed to be
fixed to include them.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
d3bdaf0

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
deps: fix MacOS and Win build for OpenSSL-1.1.1 
Because llvm on MacOS does not support AVX-512, asm files need to be limited to
AVX-2 support even when they are generated on Linux.  fake_gcc.pl returns the
fake llvm banner version for MacOS as if the assembler supports upto AVX-2.

For Windows, makefiles for nmake were updated in OpenSSL-1.1.1 and they are
rewritten into GNU makefile format by hand.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
03c94f5

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
deps: add only avx2 configs for OpenSSL-1.1.1 
OpenSSL-1.1.1 has new support of AVX-512 but AVX-2 asm files still need
to be generated for the older assembler support to keep backward
compatibilities.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
b2461f3

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
doc: fix assembler requirement for OpenSSL-1.1.1 
Add new requirements of assembler version for AVX-512 support
in OpenSSL-1.1.1.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
85d3d89

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
deps: fix for non GNU assembler in AIX 
AIX has own assembler not GNU as that does not support --noexecstack.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
b30e942

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
tls: workaround handshakedone in renegotiation 
`SSL_CB_HANDSHAKE_START` and `SSL_CB_HANDSHAKE_DONE` are called
sending HelloRequest in OpenSSL-1.1.1.
We need to check whether this is in a renegotiation state or not.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
c55f62e

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@sam-github @BethGriggs
test: assert on client and server side seperately 
This gets better coverage of the codes, and is more explicit. It also
works around ordering differences in the errors produced by openssl.
The approach was tested with 1.1.0 and 1.1.1, as well as TLSv1.2 vs
TLSv1.3. OpenSSL 1.1.0 is relevant when node is built against a shared
openssl.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
de85b38

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@sam-github @BethGriggs
deps: update archs files for OpenSSL-1.1.1a 
`cd deps/openssl/config; make` updates all archs dependant files.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
Loading status checks…
276f40c

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
deps: add s390 asm rules for OpenSSL-1.1.1 
This is a floating patch against OpenSSL-1.1.1 to generate asm files
with Makefile rules.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
0e7019f

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
deps: fix gyp/gypi for openssl-1.1.1 
Some of defines and cppflags in the build config of OpenSSL-1.1.1 were
moved to new attributes. Gyp and gypi file generations are needed to be
fixed to include them.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
70a785c

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
deps: fix MacOS and Win build for OpenSSL-1.1.1 
Because llvm on MacOS does not support AVX-512, asm files need to be limited to
AVX-2 support even when they are generated on Linux.  fake_gcc.pl returns the
fake llvm banner version for MacOS as if the assembler supports upto AVX-2.

For Windows, makefiles for nmake were updated in OpenSSL-1.1.1 and they are
rewritten into GNU makefile format by hand.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
f5369da

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
deps: add only avx2 configs for OpenSSL-1.1.1 
OpenSSL-1.1.1 has new support of AVX-512 but AVX-2 asm files still need
to be generated for the older assembler support to keep backward
compatibilities.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
639b1d2

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
doc: fix assembler requirement for OpenSSL-1.1.1 
Add new requirements of assembler version for AVX-512 support
in OpenSSL-1.1.1.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
e05eb3e

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
deps: fix for non GNU assembler in AIX 
AIX has own assembler not GNU as that does not support --noexecstack.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
56441a0

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@shigeki @BethGriggs
tls: workaround handshakedone in renegotiation 
`SSL_CB_HANDSHAKE_START` and `SSL_CB_HANDSHAKE_DONE` are called
sending HelloRequest in OpenSSL-1.1.1.
We need to check whether this is in a renegotiation state or not.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
8dd8033

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@sam-github @BethGriggs
test: assert on client and server side seperately 
This gets better coverage of the codes, and is more explicit. It also
works around ordering differences in the errors produced by openssl.
The approach was tested with 1.1.0 and 1.1.1, as well as TLSv1.2 vs
TLSv1.3. OpenSSL 1.1.0 is relevant when node is built against a shared
openssl.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
fe8e07d

BethGriggs added a commit that referenced this pull request Mar 28, 2019

@sam-github @BethGriggs
deps: update archs files for OpenSSL-1.1.1a 
`cd deps/openssl/config; make` updates all archs dependant files.

Backport-PR-URL: #26270
PR-URL: #25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Verified
This commit was signed with a verified signature.
@BethGriggs BethGriggs Bethany Nicolle Griggs
GPG key ID: D7062848A1AB005C Learn about signing commits
Loading status checks…
b0b73fa

sam-github added a commit to sam-github/node that referenced this pull request Apr 25, 2019

@shigeki @sam-github
deps: add s390 asm rules for OpenSSL-1.1.1 
This is a floating patch against OpenSSL-1.1.1 to generate asm files
with Makefile rules.

PR-URL: nodejs#25381
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Backport-PR-URL: nodejs#25688
89a2d9e

sam-github added a commit to sam-github/node that referenced this pull request Apr 26, 2019

@Trott @sam-github
doc: remove outdated s_client information in tls.md 
There is a description of how to use s_client for testing of
renegotiation limits in the `tls` module documentation. The information
is somewhat out of scope, but it also may be somewhat problematic due to
changes/peculiarities (bugs?) in recent s_client. Remove the text.

Refs: nodejs#25381 (comment)

PR-URL: nodejs#25678
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
3cee74d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.