deps: update openssl to quictls/openssl 3.0.0+quic by danbev · Pull Request #38512 · nodejs/node

danbev · 2021-05-03T06:33:00Z

This pull request updates the OpenSSL version that is statically linked with Node.js from OpenSSl 1.1.1 to quictls OpenSSL 3.0.0+quic.

This pull request will replace the OpenSSL version that is currently in the deps directory and when performing a normal build OpenSSL 3.0+quic will be statically linked to the Node.js executable. We will still be able to dynamically link to OpenSSL 1.1.1 and we have a CI job which dynamically links to OpenSSL 1.1.1 which is run for every pull request to make sure that we maintain backward compatibility.

The question is when does the community think that we should make this switch to OpenSSL 3.0+quic?

Building

$ ./configure && make -j8 test...[03:59|% 100|+ 3363|- 0]: Done

Verify that OpenSSL is statically linked

$ ldd ./node	linux-vdso.so.1 (0x00007ffff7fcf000)	libdl.so.2 => /usr/lib64/libdl.so.2 (0x00007ffff7f9d000)	libstdc++.so.6 => /usr/lib64/libstdc++.so.6 (0x00007ffff7da4000)	libm.so.6 => /usr/lib64/libm.so.6 (0x00007ffff7c5e000)	libgcc_s.so.1 => /usr/lib64/libgcc_s.so.1 (0x00007ffff7c44000)	libpthread.so.0 => /usr/lib64/libpthread.so.0 (0x00007ffff7c22000)	libc.so.6 => /usr/lib64/libc.so.6 (0x00007ffff7a59000)	/lib64/ld-linux-x86-64.so.2 (0x00007ffff7fd1000)

$ ./node -p 'process.versions.openssl'3.0.0+quic

Building with FIPS support

$ ./configure --openssl-is-fips && make -j8 test...[04:06|% 100|+ 3384|- 0]: Done

The above command will build and install the FIPS module into the out directory.
This includes building fips.so, running the installfips command that generates the FIPS configuration file (fipsmodule.cnf), copying and updating openssl.cnf to include the correct path to fipsmodule.cnf and finally uncomment the fips section.

We can then run node specifying --enable-fips:

$ ./node --enable-fips -p 'crypto.getFips()'1

The above will use the Node's default locations for OpenSSL 3.0:

$ ./out/Release/openssl-cli version -m -dOPENSSLDIR: "/home/danielbevenius/work/nodejs/openssl/out/Release/obj.target/deps/openssl"MODULESDIR: "/home/danielbevenius/work/nodejs/openssl/out/Release/obj.target/deps/openssl/lib/openssl-modules"

Hopefully having these defaults will enable for CI jobs to be configured without too much trouble, and also enable developers to configure FIPS for development/testing.

nodejs-github-bot · 2021-05-04T03:28:30Z

CI: https://ci.nodejs.org/job/node-test-pull-request/37906/

nodejs-github-bot · 2021-05-27T08:19:36Z

CI: https://ci.nodejs.org/job/node-test-pull-request/38352/

nodejs-github-bot · 2021-05-31T07:17:59Z

CI: https://ci.nodejs.org/job/node-test-pull-request/38389/

nodejs-github-bot · 2021-05-31T11:46:46Z

CI: https://ci.nodejs.org/job/node-test-pull-request/38390/

nodejs-github-bot · 2021-06-01T03:34:29Z

CI: https://ci.nodejs.org/job/node-test-pull-request/38412/

nodejs-github-bot · 2021-06-03T17:03:59Z

CI: https://ci.nodejs.org/job/node-test-pull-request/38475/

This commit adds an architecture named aix64-gcc-as which can generate assembler source code compatible with AIX assembler (as) instead of the GNU Assembler (gas). This architecture name is then used in a callback for the .p2align directive which is not available in AIX as. The motivation for this addition came out of an issue we ran into when working on upgrading OpenSSL in Node.js. We ran into the following compilation error on one of the CI machines that uses AIX: 05:39:05 Assembler: 05:39:05 crypto/bn/ppc64-mont-fixed.s: line 4: Error In Syntax This machine is using AIX Version 7.2 and does not have gas installed and the .p2align directive is causing this error. After asking around if it would be possible to install GAS on this machine I learned that AIX GNU utils are not maintained as well as the native AIX ones and we (Red Hat/IBM) have run into issues with the GNU utils in the past and if possible it would be preferable to be able to use the AIX native assembler. Refs: nodejs/node#38512

This commit adds an architecture named aix64-gcc-as which can generate assembler source code compatible with AIX assembler (as) instead of the GNU Assembler (gas). This architecture name is then used in a callback for the .p2align directive which is not available in AIX as. The motivation for this addition came out of an issue we ran into when working on upgrading OpenSSL in Node.js. We ran into the following compilation error on one of the CI machines that uses AIX: 05:39:05 Assembler: 05:39:05 crypto/bn/ppc64-mont-fixed.s: line 4: Error In Syntax This machine is using AIX Version 7.2 and does not have gas installed and the .p2align directive is causing this error. After asking around if it would be possible to install GAS on this machine I learned that AIX GNU utils are not maintained as well as the native AIX ones and we (Red Hat/IBM) have run into issues with the GNU utils in the past and if possible it would be preferable to be able to use the AIX native assembler. Refs: nodejs/node#38512 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from #15638)

nodejs-github-bot · 2021-06-08T10:12:56Z

CI: https://ci.nodejs.org/job/node-test-pull-request/38529/

danbev · 2021-06-08T10:13:56Z

Just a note that node-test-linux-linked-openssl300 is expected to fail until it has our CI has been upgraded to alpha17 or later.

This commit updates the node_metadata.{cc,h} to include openssl/quic.h which was recently added in quictls/openssl. Previously this was part of the generated openssl/crypto.h but has been moved out in Commit 5517e642fc2a531666c909aae0180e9d258d539e ("QUIC: Don't muck with FIPS checksums")

This updates all sources in deps/openssl/openssl by: $ git clone git@github.com:quictls/openssl.git $ cd node/deps/openssl $ rm -rf openssl $ cp -R ../openssl openssl $ rm -rf openssl/.git* openssl/.travis* $ git add --all openssl $ git commit openssl

After an OpenSSL source update, all the config files need to be regenerated and committed by: $ make -C deps/openssl/config $ git add deps/openssl/config/archs $ git add deps/openssl/openssl $ git commit

This commit updates the linux64-riscv64 arch files by running make linux64-riscv64 followed by a make generate_headers so that these files are generated for OpenSSL 3.0.

Remove semicolon.

nodejs-github-bot · 2021-10-10T16:08:41Z

CI: https://ci.nodejs.org/job/node-test-pull-request/40249/

nodejs-github-bot · 2021-10-10T17:55:31Z

CI: https://ci.nodejs.org/job/node-test-pull-request/40251/

danbev · 2021-10-11T04:27:25Z

Re-run of failing node-test-commit-arm-fanned ✔️

This pull request updates the OpenSSL version that is statically linked with Node.js from OpenSSl 1.1.1 to quictls OpenSSL 3.0.0+quic. This pull request will replace the OpenSSL version that is currently in the deps directory and when performing a normal build OpenSSL 3.0+quic will be statically linked to the Node.js executable. We will still be able to dynamically link to OpenSSL 1.1.1 and we have a CI job which dynamically links to OpenSSL 1.1.1 which is run for every pull request to make sure that we maintain backward compatibility. PR-URL: #38512 Reviewed-By: Michael Dawson <midawson@redhat.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>

danbev · 2021-10-11T04:30:03Z

Landed in 66da32c.

github-actionsBot added build Issues and PRs related to build files or the CI. meta Issues and PRs related to the general management of the project. needs-ci PRs that need a full CI run. openssl Issues and PRs related to the OpenSSL dependency. labels May 3, 2021

danbev added dont-land-on-v12.x quic Issues and PRs related to the QUIC implementation / HTTP/3. labels May 3, 2021

danbev force-pushed the openssl-3.0-statically-linked branch from bcc569a to 2b5ef85Compare May 3, 2021 16:30

danbev force-pushed the openssl-3.0-statically-linked branch from 2b5ef85 to eaf8adcCompare May 26, 2021 10:49

danbev changed the title ~~deps: update openssl to quictls/openssl 3.0.0-alpha15+quic (wip)~~deps: update openssl to quictls/openssl 3.0.0-alpha17+quic (wip)May 26, 2021

danbev force-pushed the openssl-3.0-statically-linked branch from 04ac9e1 to d6fb5d7Compare May 31, 2021 06:50

danbev force-pushed the openssl-3.0-statically-linked branch from d6fb5d7 to d677da6Compare May 31, 2021 11:34

danbev force-pushed the openssl-3.0-statically-linked branch from d677da6 to 955920cCompare June 1, 2021 05:57

targos removed the dont-land-on-v15.x label Jun 5, 2021

danbev mentioned this pull request Jun 7, 2021
Add aix64-gcc-as architecture and p2align callback openssl/openssl#15638
Closed

danbev force-pushed the openssl-3.0-statically-linked branch 2 times, most recently from c75fdea to a8ff58aCompare June 17, 2021 05:06

danbev force-pushed the openssl-3.0-statically-linked branch from ba291ca to a991d15Compare June 23, 2021 10:15

danbev changed the title ~~deps: update openssl to quictls/openssl 3.0.0-alpha17+quic (wip)~~deps: update openssl to quictls/openssl 3.0.0-beta1+quic (wip)Jun 23, 2021

danbev added 6 commits October 10, 2021 15:46

deps: update archs files for quictls/openssl-3.0.0+quic
e2f2a93
After an OpenSSL source update, all the config files need to be regenerated and committed by: $ make -C deps/openssl/config $ git add deps/openssl/config/archs $ git add deps/openssl/openssl $ git commit

deps: regenerate linux64-riscv64 arch files
4297b2a
This commit updates the linux64-riscv64 arch files by running make linux64-riscv64 followed by a make generate_headers so that these files are generated for OpenSSL 3.0.

squash! doc: update BUILDING.md with static FIPS section
c7795e9

squash! tools,build: add PRODUCT_DIR_ABS default gyp var
07ded8b
Remove semicolon.

danbev force-pushed the openssl-3.0-statically-linked branch from 1107e17 to 07ded8bCompare October 10, 2021 13:47

github-actionsBot mentioned this pull request Oct 11, 2021
CI Reliability 2021-10-11 nodejs/reliability#84
Open
19 tasks

danbev closed this Oct 11, 2021

This was referenced Oct 13, 2021
CI Reliability 2021-10-13 nodejs/reliability#85
Open
CI Reliability 2021-10-14 nodejs/reliability#86
Open

BethGriggs mentioned this pull request Oct 14, 2021
2021-10-19, Version 17.0.0 (Current) #40119
Merged
2 tasks

This was referenced Oct 15, 2021
CI Reliability 2021-10-15 nodejs/reliability#87
Open
CI Reliability 2021-10-16 nodejs/reliability#88
Open
CI Reliability 2021-10-17 nodejs/reliability#89
Open
CI Reliability 2021-10-18 nodejs/reliability#90
Open

tniessen mentioned this pull request Oct 26, 2021
crypto: add support for SM2 #37066
Open

tuzi3040 mentioned this pull request Nov 10, 2021
node 17.1.0 Homebrew/homebrew-core#89068
Closed

pimterry mentioned this pull request Jan 14, 2022
HTTP/3 support #38478
Open

johndevedu mentioned this pull request Apr 7, 2022
request: update OpenSSL-Strategy.md w/ strategy on Node 17/18 nodejs/TSC#1207
Closed

gengjiawen mentioned this pull request May 11, 2022
fix: update with changes for OpenSSL 3.x nodejs/gyp-next#149
Closed

PallHaraldsson mentioned this pull request Jul 4, 2022
Drop mbedTLS (and support BoringSSL (and HTTP/3)) JuliaLang/julia#45856
Closed

richardlau mentioned this pull request Oct 19, 2022
[v16.x] build: remove redundant condition from common.gypi #45076
Merged

tniessen mentioned this pull request Apr 13, 2023
Perf regression on crypto.verify nodejs/performance#72
Closed

panva mentioned this pull request Jul 27, 2026
crypto,build: require OpenSSL 3, updates to runtime FIPS APIs #64777
Draft

Navigation Menu

Uh oh!

Uh oh!

deps: update openssl to quictls/openssl 3.0.0+quic - #38512

deps: update openssl to quictls/openssl 3.0.0+quic#38512
danbev wants to merge 30 commits into
nodejs:masterfrom
danbev:openssl-3.0-statically-linked

danbev commented May 3, 2021•
edited
Loading

Uh oh!

nodejs-github-bot commented May 4, 2021

Uh oh!

nodejs-github-bot commented May 27, 2021

Uh oh!

nodejs-github-bot commented May 31, 2021

Uh oh!

nodejs-github-bot commented May 31, 2021

Uh oh!

nodejs-github-bot commented Jun 1, 2021

Uh oh!

nodejs-github-bot commented Jun 3, 2021

Uh oh!

nodejs-github-bot commented Jun 8, 2021

Uh oh!

danbev commented Jun 8, 2021

Uh oh!

nodejs-github-bot commented Oct 10, 2021

Uh oh!

nodejs-github-bot commented Oct 10, 2021

Uh oh!

danbev commented Oct 11, 2021

Uh oh!

danbev commented Oct 11, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Uh oh!

Uh oh!

Conversation

danbev commented May 3, 2021• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Building

Building with FIPS support

Uh oh!

nodejs-github-bot commented May 4, 2021

Uh oh!

nodejs-github-bot commented May 27, 2021

Uh oh!

nodejs-github-bot commented May 31, 2021

Uh oh!

nodejs-github-bot commented May 31, 2021

Uh oh!

nodejs-github-bot commented Jun 1, 2021

Uh oh!

nodejs-github-bot commented Jun 3, 2021

Uh oh!

nodejs-github-bot commented Jun 8, 2021

Uh oh!

danbev commented Jun 8, 2021

Uh oh!

nodejs-github-bot commented Oct 10, 2021

Uh oh!

nodejs-github-bot commented Oct 10, 2021

Uh oh!

danbev commented Oct 11, 2021

Uh oh!

danbev commented Oct 11, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

danbev commented May 3, 2021•
edited
Loading