- Nov 11, 2017
-
-
David Benjamin authored
OpenSSL 1.1.0 disables anonymous ciphers unless building with enable-weak-crypto. Avoid unnecessary dependencies on these ciphers in tests. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Rod Vagg <rod@vagg.org>
-
David Benjamin authored
These are both no-ops in OpenSSL 1.1.0. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
This test is testing what happens to the server if the client shuts off the connection (so the server sees ECONNRESET), but the way it does it is convoluted. It uses a static RSA key exchange with a tiny (384-bit) RSA key. The server doesn't notice (since it is static RSA, the client acts on the key first), so the client tries to encrypt a premaster and fails: rsa routines:RSA_padding_add_PKCS1_type_2:data too large for key size SSL routines:ssl3_send_client_key_exchange:bad rsa encrypt OpenSSL happens not to send an alert in this case, so we get ECONNRESET with no alert. This is quite fragile and, notably, breaks in OpenSSL 1.1.0 now that small RSA keys are rejected by libssl. Instead, test by just connecting a TCP socket and immediately closing it. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
OpenSSL 1.1.0 rejects RSA keys smaller than 1024 bits by default. Fix the tests to use larger ones. This test only cares that the PEM blob be missing a trailing newline. Certificate adapted from test/fixtures/cert.pem. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
OpenSSL 1.0.x used a 48-byte ticket key, but OpenSSL 1.1.x made it larger by using a larger HMAC-SHA256 key and using AES-256-CBC to encrypt. However, Node's public API exposes the 48-byte key. Implement the ticket key callback to restore the OpenSSL 1.0.x behavior. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
"sha" in OpenSSL refers to SHA-0 which was removed from OpenSSL 1.1.0 and is insecure. Replace it with SHA-256 which is present in both 1.0.2 and 1.1.0. Short of shipping a reimplementation in Node, this is an unavoidable behavior change with 1.1.0. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
Some errors in the two versions are different. The test-tls-no-sslv3 one because OpenSSL 1.1.x finally does version negotiation properly. 1.0.x's logic was somewhat weird and resulted in very inconsistent errors for SSLv3 in particular. Also the function codes are capitalized differently, but function codes leak implementation details, so don't assert on them to begin with. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
This aligns the documentation with reality. This API never did what Node claims it did. The SSL_CIPHER_get_version function just isn't useful. In OpenSSL 1.0.2, it always returned the string "TLSv1/SSLv3" for anything but SSLv2 ciphers, which Node does not support. Note how test-tls-multi-pfx.js claims that ECDHE-ECDSA-AES256-GCM-SHA384 was added in TLSv1/SSLv3 which is not true. That cipher is new as of TLS 1.2. The OpenSSL 1.0.2 implementation is: char *SSL_CIPHER_get_version(const SSL_CIPHER *c) { int i; if (c == NULL) return ("(NONE)"); i = (int)(c->id >> 24L); if (i == 3) return ("TLSv1/SSLv3"); else if (i == 2) return ("SSLv2"); else return ("unknown"); } In OpenSSL 1.1.0, SSL_CIPHER_get_version changed to actually behave as Node documented it, but this changes the semantics of the function and breaks tests. The cipher's minimum protocol version is not a useful notion to return to the caller here, so just hardcode the string at "TLSv1/SSLv3" and document it as legacy. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By: -
David Benjamin authored
In OpenSSL 1.1.0, EVP_dss1() is removed. These hash names were exposed in Node's public API, so add compatibility hooks for them. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
OpenSSL 1.1.0 requries HMAC_CTX be heap-allocated. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
1.1.0 requires EVP_MD_CTX be heap-allocated. In doing so, move the Init and Update hooks to shared code because they are the same between Verify and Sign. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
OpenSSL 1.1.0 requires EVP_MD_CTX be heap-allocated. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
In OpenSSL 1.1.0, EVP_CIPHER_CTX must be heap-allocated. Once we're heap-allocating them, there's no need in a separate initialised_ bit. The presence of ctx_ is sufficient. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
The callbacks are all no-ops in OpenSSL 1.1.0. This isn't necessary (the functions still exist for compatibility), but silences some warnings and avoids allocating a few unused mutexes. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
Parts of this were cherry-picked from PR #8491. Note that this only works with OpenSSL 1.0.2 or 1.1.0g or later. 1.1.0g is, as of writing, not yet released, but the fix is on the branch. See https://github.com/openssl/openssl/pull/4384. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
Add a regression test for https://github.com/openssl/openssl/pull/4384. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
This is cherry-picked from PR #8491 and tidied up. This change does *not* account for the larger ticket key in OpenSSL 1.1.0. That will be done in a follow-up commit as the 48-byte ticket key is part of Node's public API. rvagg: removed BORINGSSL defines before landing PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
These are OpenSSL-internal APIs that are no longer accessible in 1.1.0 and weren't necessary. OpenSSL will push its own errors and, if it doesn't, the calling code would handle it anyway. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
Based on a build of OpenSSL 1.1.0f. The exact sizes are not particularly important (the original value was missing all the objects hanging off anyway), only that V8 garbage collector be aware that there is some memory usage beyond the sockets themselves. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
This is cherry-picked from PR #8491 and then tidied up. The original had an unnecessarily large diff and messed up some public/private bits. PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
David Benjamin authored
In OpenSSL 1.1.0, X509_STORE_CTX is opaque and thus cannot be stack-allocated. This works in OpenSSL 1.1.0 and 1.0.2. Adapted from PR PR-URL: https://github.com/nodejs/node/pull/16130 Reviewed-By:
-
Sabari Lakshmi Krishnamoorthy authored
PR-URL: https://github.com/nodejs/node/pull/16914 Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Tobias Nießen <tniessen@tnie.de> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
-
Tanvi Kini authored
PR-URL: https://github.com/nodejs/node/pull/16913 Reviewed-By:
-
Swathi Kalahastri authored
PR-URL: https://github.com/nodejs/node/pull/16911 Reviewed-By:
-
Vidya Subramanyam authored
PR-URL: https://github.com/nodejs/node/pull/16910 Reviewed-By:
-
Refael Ackermann authored
`test-inspector-async-hook-setup-at-signal` is also flaky on VS2017
-
Joyee Cheung authored
This PR makes the prototype accessors added by StreamBase::AddMethods nonenumerable and checks the signatures in the accessors so they throw instead of raising assertions when called with incompatible receivers. They could be enumerated when inspecting the prototype with util.inspect or the inspector protocol. PR-URL: https://github.com/nodejs/node/pull/16860 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
-
Refael Ackermann authored
PR-URL: https://github.com/nodejs/node/pull/16893 Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com>
-
Yihong Wang authored
cctest has `so.59` extension when building node shared library in linux. The appending is defined in node.gypi and the cctest target in node.gyp includes node.gypi. Moving the appending from node.gypi to node target in node.gyp fixes the issue. Signed-off-by:
Yihong Wang <yh.wang@ibm.com> PR-URL: https://github.com/nodejs/node/pull/16680 Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
Refael Ackermann <refack@gmail.com>
-
cjihrig authored
Fixes: https://github.com/nodejs/node/issues/14957 PR-URL: https://github.com/nodejs/node/pull/16839 Reviewed-By:
-
cjihrig authored
PR-URL: https://github.com/nodejs/node/pull/16835 Reviewed-By:
-
cjihrig authored
There is currently one if branch missing coverage in lib/vm.js. This commit adds a test to cover the case where the third argument to runInNewContext() is a string. PR-URL: https://github.com/nodejs/node/pull/16906 Reviewed-By:
Yuta Hiroto <hello@about-hiroppy.com> Reviewed-By:
-
Neil Vass authored
Print content of domain stack if it doesn't match expected values PR-URL: https://github.com/nodejs/node/pull/16885 Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
-
- Nov 10, 2017
-
-
Franziska Hinkelmann authored
This fixes the flaky message/console test on our CI. Original commit message: [test/message] Allow numbers to have more than one leading digit. The {NUMBER} regexp only allowed one, leading to occasional test failures such as: https://build.chromium.org/p/client.v8/builders/V8%20Mac%20-%20debug/builds/17156 Bug: Change-Id: I25a08b80640d9af19ba70c61c846163685f1cb82 Reviewed-on: https://chromium-review.googlesource.com/753322 Reviewed-by:Franziska Hinkelmann <franzih@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#49109} PR-URL: https://github.com/nodejs/node/pull/16890 Ref: https://github.com/nodejs/build/issues/936 Reviewed-By:
Michaël Zasso <targos@protonmail.com> Reviewed-By:
-
Mamatha J V authored
PR-URL: https://github.com/nodejs/node/pull/16909 Reviewed-By:
Anatoli Papirovski <apapirovski@mac.com> Reviewed-By:
-
Daniel Bevenius authored
The motivation for this commit is that we need to specify system CA certificates when building node. While we are aware of the environment variable NODE_EXTRA_CA_CERTS this is not a great solution as we build an RPM and we also don't want users to be able to unset them. The suggestion is to add a configure time property like this: --openssl-system-ca-path=OPENSSL_SYSTEM_CA_PATH Use the specified path to system CA (PEM format) in addition to the OpenSSL supplied CA store or compiled- in Mozilla CA copy. Usage example: $ ./configure --openssl-system-ca-path=/etc/pki/tls/certs/ca-bundle.crt This would add the specified CA certificates in addition to the ones already being used. PR-URL: https://github.com/nodejs/node/pull/16790 Reviewed-By: -
Steven R. Loomis authored
- Update to released ICU 60.1, including: - CLDR 32 (many new languages and data improvements) - Unicode 10 (8,518 new characters, including four new scripts, 7,494 new Han characters, and 56 new emoji characters) - UTF-8 malformed bytes now handled according to W3C/WHATWG spec Fixes: https://github.com/nodejs/node/issues/15540 PR-URL: https://github.com/nodejs/node/pull/16876 Reviewed-By:
-
Rod Vagg authored
For variables such as LD_LIBRARY_PATH and DYLD_LIBRARY_PATH that are needed for dynamically linked binaries PR-URL: https://github.com/nodejs/node/pull/16405 Reviewed-By:
-
Franziska Hinkelmann authored
Add an intro section and example for the vm module. PR-URL: https://github.com/nodejs/node/pull/16867 Reviewed-By:
-
- Nov 09, 2017
-
-
Daniel Bevenius authored
This commit excludes src\tracing\trace_event.h and src\tracing\trace_event_common.h from the linter but allows the rest of the files in src\tracing to be examined by the linter which is similar to what the Makefile does. PR-URL: https://github.com/nodejs/node/pull/16720 Reviewed-By:
-
