Skip to content

[v8.x backport] Support both OpenSSL 1.1.0 and 1.0.2 #18326

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
MylesBorins wants to merge 25 commits into from
Closed

[v8.x backport] Support both OpenSSL 1.1.0 and 1.0.2 #18326

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
60b8b73
crypto: use X509_STORE_CTX_new
davidben Sep 16, 2017
7702cc3
crypto: make node_crypto_bio compat w/ OpenSSL 1.1
davidben Sep 14, 2017
f51f3e9
crypto: estimate kExternalSize
davidben Sep 16, 2017
7530865
crypto: remove unnecessary SSLerr calls
davidben Sep 16, 2017
5dcf534
crypto: account for new 1.1.0 SSL APIs
davidben Sep 17, 2017
c6decc5
crypto: test DH keys work without a public half
davidben Sep 17, 2017
da9702a
crypto: use RSA and DH accessors
davidben Sep 17, 2017
3b967ab
crypto: remove locking callbacks for OpenSSL 1.1.0
davidben Sep 18, 2017
68ea095
crypto: make CipherBase 1.1.0-compatible
davidben Sep 20, 2017
0790a4c
crypto: make Hash 1.1.0-compatible
davidben Sep 22, 2017
612c103
crypto: make SignBase compatible with OpenSSL 1.1.0
davidben Sep 22, 2017
4485ba0
crypto: Make Hmac 1.1.0-compatible
davidben Sep 22, 2017
bdb4d70
crypto: add compat logic for "DSS1" and "dss1"
davidben Sep 23, 2017
7400a06
crypto: hard-code tlsSocket.getCipher().version
davidben Sep 23, 2017
ddf4987
test: update test expectations for OpenSSL 1.1.0
davidben Sep 17, 2017
4b4a17b
test: remove sha from test expectations
davidben Sep 23, 2017
ab02259
crypto: emulate OpenSSL 1.0 ticket scheme in 1.1
davidben Sep 23, 2017
31cf594
test: test with a larger RSA key
davidben Sep 23, 2017
28a9fac
test: revise test-tls-econnreset for OpenSSL 1.1.0
davidben Sep 23, 2017
11120dd
crypto: remove deprecated ECDH calls w/ OpenSSL 1.1
davidben Sep 23, 2017
7eb8740
test: configure certs in tests
davidben Sep 23, 2017
736dd79
test: fix test-https-agent-session-eviction for 1.1
davidben Sep 23, 2017
48a355d
crypto: make ALPN the same for OpenSSL 1.0.2 & 1.1.0
davidben Sep 23, 2017
37142c6
crypto: clear some SSL_METHOD deprecation warnings
davidben Sep 18, 2017
dfaf1ec
crypto: remove leftover initialization
MylesBorins Jan 23, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
crypto: Make Hmac 1.1.0-compatible 
OpenSSL 1.1.0 requries HMAC_CTX be heap-allocated.

PR-URL: #16130
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Rod Vagg <rod@vagg.org>
  • Loading branch information
@davidben @MylesBorins
davidben authored and MylesBorins committed Feb 7, 2018
commit 4485ba08e40f486801257f9fa391093760741310
39 changes: 30 additions & 9 deletions src/node_crypto.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,20 @@ static int X509_up_ref(X509* cert) {

#define EVP_MD_CTX_new EVP_MD_CTX_create
#define EVP_MD_CTX_free EVP_MD_CTX_destroy

HMAC_CTX* HMAC_CTX_new() {
HMAC_CTX* ctx = Malloc<HMAC_CTX>(1);
HMAC_CTX_init(ctx);
return ctx;
}

void HMAC_CTX_free(HMAC_CTX* ctx) {
if (ctx == nullptr) {
return;
}
HMAC_CTX_cleanup(ctx);
free(ctx);
}
#endif // OPENSSL_VERSION_NUMBER < 0x10100000L

// Subject DER of CNNIC ROOT CA and CNNIC EV ROOT CA are taken from
Expand Down Expand Up @@ -3825,6 +3839,11 @@ void CipherBase::Final(const FunctionCallbackInfo<Value>& args) {
}


Hmac::~Hmac() {
HMAC_CTX_free(ctx_);
}


void Hmac::Initialize(Environment* env, v8::Local<v8::Object> target) {
Local<FunctionTemplate> t = env->NewFunctionTemplate(New);

Expand Down Expand Up @@ -3852,14 +3871,16 @@ void Hmac::HmacInit(const char* hash_type, const char* key, int key_len) {
if (md == nullptr) {
return env()->ThrowError("Unknown message digest");
}
HMAC_CTX_init(&ctx_);
if (key_len == 0) {
key = "";
}
if (!HMAC_Init_ex(&ctx_, key, key_len, md, nullptr)) {
ctx_ = HMAC_CTX_new();
if (ctx_ == nullptr ||
!HMAC_Init_ex(ctx_, key, key_len, md, nullptr)) {
HMAC_CTX_free(ctx_);
ctx_ = nullptr;
return ThrowCryptoError(env(), ERR_get_error());
}
initialised_ = true;
}


Expand All @@ -3883,9 +3904,9 @@ void Hmac::HmacInit(const FunctionCallbackInfo<Value>& args) {


bool Hmac::HmacUpdate(const char* data, int len) {
if (!initialised_)
if (ctx_ == nullptr)
return false;
int r = HMAC_Update(&ctx_, reinterpret_cast<const unsigned char*>(data), len);
int r = HMAC_Update(ctx_, reinterpret_cast<const unsigned char*>(data), len);
return r == 1;
}

Expand Down Expand Up @@ -3936,10 +3957,10 @@ void Hmac::HmacDigest(const FunctionCallbackInfo<Value>& args) {
unsigned char md_value[EVP_MAX_MD_SIZE];
unsigned int md_len = 0;

if (hmac->initialised_) {
HMAC_Final(&hmac->ctx_, md_value, &md_len);
HMAC_CTX_cleanup(&hmac->ctx_);
hmac->initialised_ = false;
if (hmac->ctx_ != nullptr) {
HMAC_Final(hmac->ctx_, md_value, &md_len);
HMAC_CTX_free(hmac->ctx_);
hmac->ctx_ = nullptr;
}

Local<Value> error;
Expand Down
11 changes: 3 additions & 8 deletions src/node_crypto.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -494,11 +494,7 @@ class CipherBase : public BaseObject {

class Hmac : public BaseObject {
public:
~Hmac() override {
if (!initialised_)
return;
HMAC_CTX_cleanup(&ctx_);
}
~Hmac() override;

static void Initialize(Environment* env, v8::Local<v8::Object> target);

Expand All @@ -513,13 +509,12 @@ class Hmac : public BaseObject {

Hmac(Environment* env, v8::Local<v8::Object> wrap)
: BaseObject(env, wrap),
initialised_(false) {
ctx_(nullptr) {
MakeWeak<Hmac>(this);
}

private:
HMAC_CTX ctx_; /* coverity[member_decl] */
bool initialised_;
HMAC_CTX* ctx_;
};

class Hash : public BaseObject {
Expand Down