Skip to content

Commit 5df9bc7

Browse files
committed
OpenSSL 1.1.1 support
Ported from OpenSUSE:nodejs8-8.17.0-lp152.147.1:openssl_1_1_1.patch Original commit message: Backport OpenSSL 1.1.1 support, mostly be disabling TLS 1.3 Upstream commits: commit 8dd8033 Author: Shigeki Ohtsu <[email protected]> Date: Wed Sep 12 17:34:24 2018 +0900 tls: workaround handshakedone in renegotiation `SSL_CB_HANDSHAKE_START` and `SSL_CB_HANDSHAKE_DONE` are called sending HelloRequest in OpenSSL-1.1.1. We need to check whether this is in a renegotiation state or not. Backport-PR-URL: nodejs#26270 PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <[email protected]> Reviewed-By: Shigeki Ohtsu <[email protected]> commit 161dca7 Author: Sam Roberts <[email protected]> Date: Wed Nov 28 14:11:18 2018 -0800 tls: re-define max supported version as 1.2 Several secureProtocol strings allow any supported TLS version as the maximum, but our maximum supported protocol version is TLSv1.2 even if someone configures a build against an OpenSSL that supports TLSv1.3. Fixes: nodejs#24658 PR-URL: nodejs#25024 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Daniel Bevenius <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Partial port, remain compatible with 1.0.2: commit 970ce14 Author: Shigeki Ohtsu <[email protected]> Date: Wed Mar 14 14:26:55 2018 +0900 crypto: remove deperecated methods of TLS version All version-specific methods were deprecated in OpenSSL 1.1.0 and min/max versions explicitly need to be set. This still keeps comptatible with JS and OpenSSL-1.0.2 APIs for now. crypto, constants: add constant of OpenSSL-1.1.0 Several constants for OpenSSL-1.1.0 engine were removed and renamed in OpenSSL-1.1.0. This added one renamed constant in order to have a compatible feature with that of OpenSSL-1.0.2. Other missed or new constants in OpenSSL-1.1.0 are not yet added. crypto,tls,constants: remove OpenSSL1.0.2 support This is semver-majar change so that we need not to have compatibilities with older versions. Fixes: nodejs#4270 PR-URL: nodejs#19794 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rod Vagg <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Signed-off-by: Su Baocheng <[email protected]>
1 parent 92a136d commit 5df9bc7

File tree

3 files changed

+83
-1
lines changed

3 files changed

+83
-1
lines changed

src/node_constants.cc

+4
Original file line numberDiff line numberDiff line change
@@ -921,6 +921,10 @@ void DefineOpenSSLConstants(Local<Object> target) {
921921
NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_ECDSA);
922922
# endif
923923

924+
# ifdef ENGINE_METHOD_EC
925+
NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_EC);
926+
# endif
927+
924928
# ifdef ENGINE_METHOD_CIPHERS
925929
NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_CIPHERS);
926930
# endif

src/node_crypto.cc

+75
Original file line numberDiff line numberDiff line change
@@ -509,6 +509,8 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
509509
ASSIGN_OR_RETURN_UNWRAP(&sc, args.Holder());
510510
Environment* env = sc->env();
511511

512+
int min_version = 0;
513+
int max_version = 0;
512514
const SSL_METHOD* method = TLS_method();
513515

514516
if (args.Length() == 1 && args[0]->IsString()) {
@@ -531,29 +533,95 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
531533
} else if (strcmp(*sslmethod, "SSLv3_client_method") == 0) {
532534
return env->ThrowError("SSLv3 methods disabled");
533535
} else if (strcmp(*sslmethod, "SSLv23_method") == 0) {
536+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
537+
method = TLS_method();
538+
#else
534539
method = SSLv23_method();
540+
#endif
535541
} else if (strcmp(*sslmethod, "SSLv23_server_method") == 0) {
542+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
543+
method = TLS_server_method();
544+
#else
536545
method = SSLv23_server_method();
546+
#endif
537547
} else if (strcmp(*sslmethod, "SSLv23_client_method") == 0) {
548+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
549+
method = TLS_client_method();
550+
#else
538551
method = SSLv23_client_method();
552+
#endif
539553
} else if (strcmp(*sslmethod, "TLSv1_method") == 0) {
554+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
555+
min_version = TLS1_VERSION;
556+
max_version = TLS1_VERSION;
557+
method = TLS_method();
558+
#else
540559
method = TLSv1_method();
560+
#endif
541561
} else if (strcmp(*sslmethod, "TLSv1_server_method") == 0) {
562+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
563+
min_version = TLS1_VERSION;
564+
max_version = TLS1_VERSION;
565+
method = TLS_server_method();
566+
#else
542567
method = TLSv1_server_method();
568+
#endif
543569
} else if (strcmp(*sslmethod, "TLSv1_client_method") == 0) {
570+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
571+
min_version = TLS1_VERSION;
572+
max_version = TLS1_VERSION;
573+
method = TLS_client_method();
574+
#else
544575
method = TLSv1_client_method();
576+
#endif
545577
} else if (strcmp(*sslmethod, "TLSv1_1_method") == 0) {
578+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
579+
min_version = TLS1_1_VERSION;
580+
max_version = TLS1_1_VERSION;
581+
method = TLS_method();
582+
#else
546583
method = TLSv1_1_method();
584+
#endif
547585
} else if (strcmp(*sslmethod, "TLSv1_1_server_method") == 0) {
586+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
587+
min_version = TLS1_1_VERSION;
588+
max_version = TLS1_1_VERSION;
589+
method = TLS_server_method();
590+
#else
548591
method = TLSv1_1_server_method();
592+
#endif
549593
} else if (strcmp(*sslmethod, "TLSv1_1_client_method") == 0) {
594+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
595+
min_version = TLS1_1_VERSION;
596+
max_version = TLS1_1_VERSION;
597+
method = TLS_client_method();
598+
#else
550599
method = TLSv1_1_client_method();
600+
#endif
551601
} else if (strcmp(*sslmethod, "TLSv1_2_method") == 0) {
602+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
603+
min_version = TLS1_2_VERSION;
604+
max_version = TLS1_2_VERSION;
605+
method = TLS_method();
606+
#else
552607
method = TLSv1_2_method();
608+
#endif
553609
} else if (strcmp(*sslmethod, "TLSv1_2_server_method") == 0) {
610+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
611+
min_version = TLS1_2_VERSION;
612+
max_version = TLS1_2_VERSION;
613+
method = TLS_server_method();
614+
#else
554615
method = TLSv1_2_server_method();
616+
#endif
555617
} else if (strcmp(*sslmethod, "TLSv1_2_client_method") == 0) {
618+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
619+
min_version = TLS1_2_VERSION;
620+
max_version = TLS1_2_VERSION;
621+
method = TLS_client_method();
622+
#else
556623
method = TLSv1_2_client_method();
624+
#endif
557625
} else {
558626
return env->ThrowError("Unknown method");
559627
}
@@ -578,6 +646,13 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
578646
SSL_CTX_sess_set_new_cb(sc->ctx_, SSLWrap<Connection>::NewSessionCallback);
579647

580648
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
649+
SSL_CTX_set_min_proto_version(sc->ctx_, min_version);
650+
if (max_version == 0) {
651+
// Selecting some secureProtocol methods allows the TLS version to be "any
652+
// supported", but we don't support TLSv1.3, even if OpenSSL does.
653+
max_version = TLS1_2_VERSION;
654+
}
655+
SSL_CTX_set_max_proto_version(sc->ctx_, max_version);
581656
// OpenSSL 1.1.0 changed the ticket key size, but the OpenSSL 1.0.x size was
582657
// exposed in the public API. To retain compatibility, install a callback
583658
// which restores the old algorithm.

src/tls_wrap.cc

+4-1
Original file line numberDiff line numberDiff line change
@@ -277,7 +277,10 @@ void TLSWrap::SSLInfoCallback(const SSL* ssl_, int where, int ret) {
277277
}
278278
}
279279

280-
if (where & SSL_CB_HANDSHAKE_DONE) {
280+
// SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE are called
281+
// sending HelloRequest in OpenSSL-1.1.1.
282+
// We need to check whether this is in a renegotiation state or not.
283+
if (where & SSL_CB_HANDSHAKE_DONE && !SSL_renegotiate_pending(ssl)) {
281284
c->established_ = true;
282285
Local<Value> callback = object->Get(env->onhandshakedone_string());
283286
if (callback->IsFunction()) {

0 commit comments

Comments
 (0)