[patch] nodejs-8.8.1-openssl-1.1-p2.patch

nodejs-8.8.1-openssl-1.1-p2.patch (text/plain), 5.82 KB, created by Mark Wright on 2017-10-29 05:43:56 UTC

--- node-v8.8.1-orig/src/node_crypto.cc	2017-10-29 11:51:11.037518215 +1100
+++ node-v8.8.1/src/node_crypto.cc	2017-10-29 16:17:50.166598373 +1100
@@ -45,6 +45,10 @@
 // StartComAndWoSignData.inc
 #include "StartComAndWoSignData.inc"
 
+#include <openssl/bn.h>
+#include <openssl/dh.h>
+#include <openssl/rsa.h>
+
 #include <errno.h>
 #include <limits.h>  // INT_MAX
 #include <math.h>
@@ -547,6 +551,13 @@
   new SecureContext(env, args.This());
 }
 
+static void set_protocol_version(const SSL_METHOD *m, int version)
+{
+    SSL_CTX *ctx = SSL_CTX_new(m);
+    SSL_CTX_set_min_proto_version(ctx, version);
+    SSL_CTX_set_max_proto_version(ctx, version);
+    SSL_CTX_free(ctx);
+}
 
 void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
   SecureContext* sc;
@@ -581,23 +592,32 @@
     } else if (strcmp(*sslmethod, "SSLv23_client_method") == 0) {
       method = SSLv23_client_method();
     } else if (strcmp(*sslmethod, "TLSv1_method") == 0) {
-      method = TLSv1_method();
+      method = TLS_method();
+      set_protocol_version(method, TLS1_VERSION);
     } else if (strcmp(*sslmethod, "TLSv1_server_method") == 0) {
-      method = TLSv1_server_method();
+      method = TLS_server_method();
+      set_protocol_version(method, TLS1_VERSION);
     } else if (strcmp(*sslmethod, "TLSv1_client_method") == 0) {
-      method = TLSv1_client_method();
+      method = TLS_client_method();
+      set_protocol_version(method, TLS1_VERSION);
     } else if (strcmp(*sslmethod, "TLSv1_1_method") == 0) {
-      method = TLSv1_1_method();
+      method = TLS_method();
+      set_protocol_version(method, TLS1_1_VERSION);
     } else if (strcmp(*sslmethod, "TLSv1_1_server_method") == 0) {
-      method = TLSv1_1_server_method();
+      method = TLS_server_method();
+      set_protocol_version(method, TLS1_1_VERSION);
     } else if (strcmp(*sslmethod, "TLSv1_1_client_method") == 0) {
-      method = TLSv1_1_client_method();
+      method = TLS_client_method();
+      set_protocol_version(method, TLS1_1_VERSION);
     } else if (strcmp(*sslmethod, "TLSv1_2_method") == 0) {
-      method = TLSv1_2_method();
+      method = TLS_method();
+      set_protocol_version(method, TLS1_2_VERSION);
     } else if (strcmp(*sslmethod, "TLSv1_2_server_method") == 0) {
-      method = TLSv1_2_server_method();
+      method = TLS_server_method();
+      set_protocol_version(method, TLS1_2_VERSION);
     } else if (strcmp(*sslmethod, "TLSv1_2_client_method") == 0) {
-      method = TLSv1_2_client_method();
+      method = TLS_client_method();
+      set_protocol_version(method, TLS1_2_VERSION);
     } else {
       return env->ThrowError("Unknown method");
     }
@@ -1826,14 +1846,14 @@
     rsa = nullptr;
   }
 
-  ASN1_TIME_print(bio, X509_get_notBefore(cert));
+  ASN1_TIME_print(bio, X509_get0_notBefore(cert));
   BIO_get_mem_ptr(bio, &mem);
   info->Set(env->valid_from_string(),
             String::NewFromUtf8(env->isolate(), mem->data,
                                 String::kNormalString, mem->length));
   (void) BIO_reset(bio);
 
-  ASN1_TIME_print(bio, X509_get_notAfter(cert));
+  ASN1_TIME_print(bio, X509_get0_notAfter(cert));
   BIO_get_mem_ptr(bio, &mem);
   info->Set(env->valid_to_string(),
             String::NewFromUtf8(env->isolate(), mem->data,
@@ -3011,7 +3031,7 @@
     return true;
 
   time_t october_21_2016 = static_cast<time_t>(1477008000);
-  if (X509_cmp_time(X509_get_notBefore(cert), &october_21_2016) < 0)
+  if (X509_cmp_time(X509_get0_notBefore(cert), &october_21_2016) < 0)
     return true;
 
   return false;
@@ -3918,7 +3938,7 @@
 void Hmac::HmacInit(const char* hash_type, const char* key, int key_len) {
   HandleScope scope(env()->isolate());
 
-  CHECK_EQ(initialised_, false);
+  CHECK_EQ(ctx_, nullptr);
   const EVP_MD* md = EVP_get_digestbyname(hash_type);
   if (md == nullptr) {
     return env()->ThrowError("Unknown message digest");
@@ -4066,7 +4086,7 @@
 
 
 bool Hash::HashInit(const char* hash_type) {
-  CHECK_EQ(initialised_, false);
+  CHECK_EQ(mdctx_, nullptr);
   const EVP_MD* md = EVP_get_digestbyname(hash_type);
   if (md == nullptr)
     return false;
@@ -4098,7 +4118,7 @@
 
   THROW_AND_RETURN_IF_NOT_STRING_OR_BUFFER(args[0], "Data");
 
-  if (!hash->initialised_) {
+  if (hash->mdctx_ == nullptr) {
     return env->ThrowError("Not initialized");
   }
   if (hash->finalized_) {
@@ -4130,7 +4150,7 @@
   Hash* hash;
   ASSIGN_OR_RETURN_UNWRAP(&hash, args.Holder());
 
-  if (!hash->initialised_) {
+  if (hash->mdctx_ == nullptr) {
     return env->ThrowError("Not initialized");
   }
   if (hash->finalized_) {
@@ -5154,7 +5174,7 @@
     OPENSSL_VERSION_NUMBER < 0x10100070L
 // Older versions of OpenSSL 1.1.0 have a DH_set0_key which does not work for
 // Node. See https://github.com/openssl/openssl/pull/4384.
-#error "OpenSSL 1.1.0 revisions before 1.1.0g are not supported"
+#warning "OpenSSL 1.1.0 revisions before 1.1.0g are not supported"
 #endif
   SetKey(args, [](DH* dh, BIGNUM* num) { DH_set0_key(dh, nullptr, num); },
          "Private key");
@@ -6209,8 +6229,8 @@
 }
 
 void InitCryptoOnce() {
-  SSL_load_error_strings();
-  OPENSSL_no_config();
+  OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+  OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_NO_LOAD_CONFIG, NULL);
 
   // --openssl-config=...
   if (!openssl_config.empty()) {
@@ -6232,8 +6252,7 @@
     }
   }
 
-  SSL_library_init();
-  OpenSSL_add_all_algorithms();
+  OPENSSL_init_ssl(0, NULL);
 
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
   crypto_lock_init();
--- node-v8.8.1-orig/src/node_crypto.h	2017-10-29 14:06:40.775558946 +1100
+++ node-v8.8.1/src/node_crypto.h	2017-10-29 14:07:08.704559086 +1100
@@ -52,6 +52,7 @@
 #include <openssl/hmac.h>
 #include <openssl/rand.h>
 #include <openssl/pkcs12.h>
+#include <openssl/dh.h>
 
 #if !defined(OPENSSL_NO_TLSEXT) && defined(SSL_CTX_set_tlsext_status_cb)
 # define NODE__HAVE_TLSEXT_STATUS_CB