Upgrade to openssl 102h for master #6550

shigeki · 2016-05-03T19:33:57Z

Checklist

tests and code linting passes
a test and/or benchmark is included
documentation is changed or added
the commit message follows commit guidelines

Affected core subsystem(s)

tls/crypto

Description of change

openssl sources are upgraded to 1.0.2h and applied floating patches.
Two more works was made in this upgrade.

asm regenerated

asm codes were changed in this upgrade so that asm and asm_obsolete were regenerated. openssl headers were unchanged so that config/ are not regenerated.

ALPN test fixes

openssl/openssl@af2db04 changed some ALPN behaviors. The tests when ALPN has no selection
should be fixed because openssl was changed NPN callback to be invoked in this case.

Fix: #6458
R: @indutny or @bnoordhuis

This replaces all sources of openssl-1.0.2h.tar.gz into deps/openssl/openssl

All symlink files in `deps/openssl/openssl/include/openssl/` are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h.

`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: nodejs#589 PR-URL: nodejs#1389 Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Shigeki Ohtsu <[email protected]>

See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: nodejs#589 PR-URL: nodejs#1389 Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>

Reapply b910613 . Fixes: nodejs#589 PR-URL: nodejs#1389 Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>

In openssl s_client on Windows, RAND_screen() is invoked to initialize random state but it takes several seconds in each connection. This added -no_rand_screen to openssl s_client on Windows to skip RAND_screen() and gets a better performance in the unit test of test-tls-server-verify. Do not enable this except to use in the unit test. Fixes: nodejs#1461 PR-URL: nodejs#1836 Reviewed-By: Ben Noordhuis <[email protected]>

Regenerate asm files with Makefile and CC=gcc and ASM=gcc where gcc-4.8.4. Also asm files in asm_obsolete dir to support old compiler and assembler are regenerated without CC and ASM envs.

openssl/openssl@af2db04 changed some ALPN behaviors. The tests when ALPN has no selection should be fixed because openssl was changed NPN callback to be invoked in this case.

shigeki · 2016-05-03T19:34:32Z

CI is green in https://ci.nodejs.org/job/node-test-commit/3160/

MylesBorins · 2016-05-03T19:40:32Z

@shigeki should this backport cleanly to v4 - > v6 or will it require a custom backport?

shigeki · 2016-05-03T19:43:21Z

@thealphanerd v4 does not support ALPN so that 3f4e596 cannot be backported. I think others would be fine.

MylesBorins · 2016-05-03T19:45:23Z

I'll make a PR to backport this to v5 and v4

MylesBorins · 2016-05-03T19:48:22Z

LGMT btw

indutny · 2016-05-03T19:50:40Z

LGTM, verified sources.

indutny · 2016-05-03T23:40:57Z

cc @bnoordhuis ;)

bnoordhuis · 2016-05-04T09:34:48Z

LGTM

Aside: I think I've brought this up before but the way we do upgrades now (basically: nuke deps/openssl, unpack tarball, reapply patches) makes the history very noisy. Is there a reason we don't simply apply the diff between 1.0.2g and 1.0.2h onto our tree?

shigeki · 2016-05-04T14:57:39Z

@bnoordhuis I agree that the history gets noisy but I made upgrade procedure for two reasons.

it shows clear process to upgrade from new sources. Other people can understand what is applied to deps/openssl from recent git log and find what especially floating patches are needed.
openssl build system sometimes are changed after upgrade with adding/removing files and generating some files dynamically with perl scripts. I think we can have more robust procedure of upgrading from official sources every time.

As you know, upgrading openssl is somehow tricky work. I would like make it to be more easier for others who are not familiar with openssl can just follow instructed steps.

This replaces all sources of openssl-1.0.2h.tar.gz into deps/openssl/openssl Fixes: #6458 PR-URL: #6550 Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>

All symlink files in `deps/openssl/openssl/include/openssl/` are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Fixes: #6458 PR-URL: #6550 Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>

Regenerate asm files with Makefile and CC=gcc and ASM=gcc where gcc-4.8.4. Also asm files in asm_obsolete dir to support old compiler and assembler are regenerated without CC and ASM envs. Fixes: #6458 PR-URL: #6550 Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>

openssl/openssl@af2db04 changed some ALPN behaviors. The tests when ALPN has no selection should be fixed because openssl was changed NPN callback to be invoked in this case. Fixes: #6458 PR-URL: #6550 Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>

shigeki · 2016-05-04T15:37:15Z

Thanks everyone. Landed in 59c8e46, 63f090f, 70acd47, 4e4a4e1, f136f72, e673a93, 70ae031 and be480b1.

Fishrock123 · 2016-05-04T15:46:54Z

Awesome. Will pull into the v6 proposal momentarily.

This replaces all sources of openssl-1.0.2h.tar.gz into deps/openssl/openssl Fixes: nodejs#6458 PR-URL: nodejs#6550 Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>

All symlink files in `deps/openssl/openssl/include/openssl/` are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Fixes: nodejs#6458 PR-URL: nodejs#6550 Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>

Regenerate asm files with Makefile and CC=gcc and ASM=gcc where gcc-4.8.4. Also asm files in asm_obsolete dir to support old compiler and assembler are regenerated without CC and ASM envs. Fixes: nodejs#6458 PR-URL: nodejs#6550 Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>

openssl/openssl@af2db04 changed some ALPN behaviors. The tests when ALPN has no selection should be fixed because openssl was changed NPN callback to be invoked in this case. Fixes: nodejs#6458 PR-URL: nodejs#6550 Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>

* assert: `deep{Strict}Equal()` now works correctly with circular references. (Rich Trott) #6432 * debugger: Arrays are now formatted correctly in the debugger repl. (cjihrig) #6448 * deps: Upgrade OpenSSL sources to 1.0.2h (Shigeki Ohtsu) #6550 * net: Introduced a `Socket#connecting` property. (Fedor Indutny) #6404 - Previously this information was only available as the undocumented, internal `_connecting` property. * process: Introduced `process.cpuUsage()`. (Patrick Mueller) #6157 * stream: `Writable#setDefaultEncoding()` now returns `this`. (Alexander Makarenko) #5040 * util: Two new additions to `util.inspect()`: - Added a `maxArrayLength` option to truncate the formatting of Arrays. (James M Snell) #6334 - This is set to `100` by default. - Added a `showProxy` option for formatting proxy intercepting handlers. (James M Snell) #6465 - Inspecting proxies is non-trivial and as such this is off by default. PR-URL: #6557

* assert: `deep{Strict}Equal()` now works correctly with circular references. (Rich Trott) #6432 * debugger: Arrays are now formatted correctly in the debugger repl. (cjihrig) #6448 * deps: Upgrade OpenSSL sources to 1.0.2h (Shigeki Ohtsu) #6550 - Please see our blog post for more info on the security contents of this release: - https://nodejs.org/en/blog/vulnerability/openssl-may-2016/ * net: Introduced a `Socket#connecting` property. (Fedor Indutny) #6404 - Previously this information was only available as the undocumented, internal `_connecting` property. * process: Introduced `process.cpuUsage()`. (Patrick Mueller) #6157 * stream: `Writable#setDefaultEncoding()` now returns `this`. (Alexander Makarenko) #5040 * util: Two new additions to `util.inspect()`: - Added a `maxArrayLength` option to truncate the formatting of Arrays. (James M Snell) #6334 - This is set to `100` by default. - Added a `showProxy` option for formatting proxy intercepting handlers. (James M Snell) #6465 - Inspecting proxies is non-trivial and as such this is off by default. PR-URL: #6557

dan-mcdonald · 2016-08-26T19:55:00Z

@shigeki This change appears to have added two files:

deps/openssl/openssl/Makefile
deps/openssl/openssl/Makefile.bak

Was that intentional? I think these files are automatically generated.

cherry-pick 65030c7 from v6-staging. openssl/openssl@af2db04 changed some ALPN behaviors. The tests when ALPN has no selection should be fixed because openssl was changed NPN callback to be invoked in this case. Fixes: #6458 PR-URL: #6550 Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>

Shigeki Ohtsu and others added 8 commits May 3, 2016 23:48

deps: upgrade openssl sources to 1.0.2h

241aef0

This replaces all sources of openssl-1.0.2h.tar.gz into deps/openssl/openssl

deps: copy all openssl header files to include dir

72346e1

All symlink files in `deps/openssl/openssl/include/openssl/` are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h.

openssl: fix keypress requirement in apps on win32

e1f68a4

Reapply b910613 . Fixes: nodejs#589 PR-URL: nodejs#1389 Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>

deps: update openssl asm and asm_obsolete files

db47579

Regenerate asm files with Makefile and CC=gcc and ASM=gcc where gcc-4.8.4. Also asm files in asm_obsolete dir to support old compiler and assembler are regenerated without CC and ASM envs.

test: fix alpn tests for openssl1.0.2h

3f4e596

openssl/openssl@af2db04 changed some ALPN behaviors. The tests when ALPN has no selection should be fixed because openssl was changed NPN callback to be invoked in this case.

nodejs-github-bot added the openssl Issues and PRs related to the OpenSSL dependency. label May 3, 2016

MylesBorins added dont-land-on-v5.x labels May 3, 2016

This was referenced May 4, 2016

Propose v6.1.0 wrong base please ignore #6556

Closed

Propose v6.1.0 (Openssl update) #6557

Merged

shigeki closed this May 4, 2016

MylesBorins mentioned this pull request Jan 24, 2017

v4.8.0 proposal #10973

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade to openssl 102h for master #6550

Upgrade to openssl 102h for master #6550

shigeki commented May 3, 2016

shigeki commented May 3, 2016

MylesBorins commented May 3, 2016

shigeki commented May 3, 2016

MylesBorins commented May 3, 2016

MylesBorins commented May 3, 2016

indutny commented May 3, 2016

indutny commented May 3, 2016

bnoordhuis commented May 4, 2016

shigeki commented May 4, 2016

shigeki commented May 4, 2016

Fishrock123 commented May 4, 2016

dan-mcdonald commented Aug 26, 2016

Upgrade to openssl 102h for master #6550

Upgrade to openssl 102h for master #6550

Conversation

shigeki commented May 3, 2016

Checklist

Affected core subsystem(s)

Description of change

shigeki commented May 3, 2016

MylesBorins commented May 3, 2016

shigeki commented May 3, 2016

MylesBorins commented May 3, 2016

MylesBorins commented May 3, 2016

indutny commented May 3, 2016

indutny commented May 3, 2016

bnoordhuis commented May 4, 2016

shigeki commented May 4, 2016

shigeki commented May 4, 2016

Fishrock123 commented May 4, 2016

dan-mcdonald commented Aug 26, 2016