Upgrade openssl to 1.0.2f #4961

MylesBorins · 2016-01-30T01:34:56Z

This PR updates openssl to version 1.0.2f

This is in accordance with the security advisory that was posted in #4857

It was done following the steps documented in https://github.com/TheAlphaNerd/node/blob/f48bce95eea9ad5b15a0872a194fa66623f0e5ba/deps/openssl/doc/UPGRADING.md

MylesBorins · 2016-01-30T01:35:23Z

I think we can safely drop MylesBorins@0185025

This replaces all sources of openssl-1.0.2f.tar.gz into deps/openssl/openssl PR-URL: nodejs#4961 Reviewed-By:

All symlink files in deps/openssl/openssl/include/openssl/ are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. PR-URL: nodejs#4961 Reviewed-By:

`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: nodejs#589 PR-URL: nodejs#1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>

See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: nodejs#589 PR-URL: nodejs#1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Reapply b910613 . Fixes: nodejs#589 PR-URL: nodejs#1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

In openssl s_client on Windows, RAND_screen() is invoked to initialize random state but it takes several seconds in each connection. This added -no_rand_screen to openssl s_client on Windows to skip RAND_screen() and gets a better performance in the unit test of test-tls-server-verify. Do not enable this except to use in the unit test. Fixes: nodejs#1461 PR-URL: nodejs#1836 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Regenerate config files for supported platforms with Makefile. PR-URL: nodejs#4961 Reviewed-By:

the guide is now current with the steps taken to update openssl to v1.0.2f PR-URL: nodejs#4961 Reviewed-By:

MylesBorins · 2016-01-30T01:41:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/1437/
citgm: https://ci.nodejs.org/job/thealphanerd-smoker/54/

edit: CI is green

This replaces all sources of openssl-1.0.2f.tar.gz into deps/openssl/openssl PR-URL: nodejs#4961 Reviewed-By:

All symlink files in deps/openssl/openssl/include/openssl/ are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. PR-URL: nodejs#4961 Reviewed-By:

the guide is now current with the steps taken to update openssl to v1.0.2f PR-URL: nodejs#4961 Reviewed-By:

MylesBorins · 2016-01-31T00:02:14Z

I've opened #4983 targeting v4

MylesBorins · 2016-01-31T00:05:37Z

The failures on citgm appear unrelated

This replaces all sources of openssl-1.0.2f.tar.gz into deps/openssl/openssl Fix: #4857 PR-URL: #4961 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp> deps: copy openssl header files to include dir All symlink files in deps/openssl/openssl/include/openssl/ are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Fix: #4857 PR-URL: #4961 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp> deps: fix openssl assembly error on ia32 win32 `x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: #589 PR-URL: #1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp> deps: fix asm build error of openssl in x86_win32 See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: #589 PR-URL: #1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> openssl: fix keypress requirement in apps on win32 Reapply b910613 . Fixes: #589 PR-URL: #1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> docs: update openssl UPDATING guide the guide is now current with the steps taken to update openssl to v1.0.2f PR-URL: #4961 Reviewed-By: Myles Borins <mborins@us.ibm.com>

shigeki · 2016-01-31T06:42:48Z

LGTM and landed for master in 1f43478 and bdd37e1,
for v5.x in cfc44c3 and 9f643af,
for v4.x-staging in 7bd9fab and fcb8cae.

The -no_rand_screen commit is not squashed because it resolved conflicts and worth while to reuse in the future upgrade.

Thanks @thealphanerd for a great work for upgrading.

This replaces all sources of openssl-1.0.2f.tar.gz into deps/openssl/openssl Fix: #4857 PR-URL: #4961 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp> deps: copy openssl header files to include dir All symlink files in deps/openssl/openssl/include/openssl/ are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Fix: #4857 PR-URL: #4961 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp> deps: fix openssl assembly error on ia32 win32 `x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: #589 PR-URL: #1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp> deps: fix asm build error of openssl in x86_win32 See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: #589 PR-URL: #1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> openssl: fix keypress requirement in apps on win32 Reapply b910613 . Fixes: #589 PR-URL: #1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> docs: update openssl UPDATING guide the guide is now current with the steps taken to update openssl to v1.0.2f PR-URL: #4961 Reviewed-By: Myles Borins <mborins@us.ibm.com>

This replaces all sources of openssl-1.0.2f.tar.gz into deps/openssl/openssl Fix: nodejs#4857 PR-URL: nodejs#4961 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp> deps: copy openssl header files to include dir All symlink files in deps/openssl/openssl/include/openssl/ are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Fix: nodejs#4857 PR-URL: nodejs#4961 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp> deps: fix openssl assembly error on ia32 win32 `x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: nodejs#589 PR-URL: nodejs#1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp> deps: fix asm build error of openssl in x86_win32 See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: nodejs#589 PR-URL: nodejs#1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> openssl: fix keypress requirement in apps on win32 Reapply b910613 . Fixes: nodejs#589 PR-URL: nodejs#1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> docs: update openssl UPDATING guide the guide is now current with the steps taken to update openssl to v1.0.2f PR-URL: nodejs#4961 Reviewed-By: Myles Borins <mborins@us.ibm.com>

Myles Borins and others added 8 commits January 29, 2016 17:38

deps: upgrade openssl sources to 1.0.2f

c8649fa

This replaces all sources of openssl-1.0.2f.tar.gz into deps/openssl/openssl PR-URL: nodejs#4961 Reviewed-By:

openssl: fix keypress requirement in apps on win32

05469c3

Reapply b910613 . Fixes: nodejs#589 PR-URL: nodejs#1389 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

deps: update openssl config files

0185025

Regenerate config files for supported platforms with Makefile. PR-URL: nodejs#4961 Reviewed-By:

docs: update openssl UPDATING guide

f48bce9

the guide is now current with the steps taken to update openssl to v1.0.2f PR-URL: nodejs#4961 Reviewed-By:

MylesBorins force-pushed the openssl-1.0.2f branch from c5f3469 to f48bce9 Compare January 30, 2016 01:38

mscdex added the openssl Issues and PRs related to the OpenSSL dependency. label Jan 30, 2016

MylesBorins added lts-watch-v4.x and removed lts-watch-v4.x labels Jan 30, 2016

MylesBorins pushed a commit to MylesBorins/node that referenced this pull request Jan 31, 2016

deps: upgrade openssl sources to 1.0.2f

adebca6

This replaces all sources of openssl-1.0.2f.tar.gz into deps/openssl/openssl PR-URL: nodejs#4961 Reviewed-By:

MylesBorins pushed a commit to MylesBorins/node that referenced this pull request Jan 31, 2016

docs: update openssl UPDATING guide

6455120

the guide is now current with the steps taken to update openssl to v1.0.2f PR-URL: nodejs#4961 Reviewed-By:

shigeki closed this Jan 31, 2016

shigeki mentioned this pull request Jan 31, 2016

Openssl 1.0.2f v4.x #4983

Closed

MylesBorins deleted the openssl-1.0.2f branch February 1, 2016 20:38

rvagg mentioned this pull request Feb 8, 2016

Release proposal: v5.5.1 (Stable) #5141

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade openssl to 1.0.2f #4961

Upgrade openssl to 1.0.2f #4961

MylesBorins commented Jan 30, 2016

MylesBorins commented Jan 30, 2016

MylesBorins commented Jan 30, 2016

MylesBorins commented Jan 31, 2016

MylesBorins commented Jan 31, 2016

shigeki commented Jan 31, 2016

Upgrade openssl to 1.0.2f #4961

Upgrade openssl to 1.0.2f #4961

Conversation

MylesBorins commented Jan 30, 2016

MylesBorins commented Jan 30, 2016

MylesBorins commented Jan 30, 2016

MylesBorins commented Jan 31, 2016

MylesBorins commented Jan 31, 2016

shigeki commented Jan 31, 2016