Skip to content

crypto: use SSL_get_servername. - #9347

Closed
agl wants to merge 1 commit into
nodejs:masterfrom
agl:getsni
Closed

crypto: use SSL_get_servername.#9347
agl wants to merge 1 commit into
nodejs:masterfrom
agl:getsni

Conversation

@agl

@aglagl commented Oct 28, 2016

Copy link
Copy Markdown
Contributor
Checklist
  • make -j8 test (UNIX), or vcbuild test nosign (Windows) passes
  • tests and/or benchmarks are included
  • documentation is changed or added
  • commit message follows commit guidelines
Affected core subsystem(s)

crypto

Description of change

(Patch by David Benjamin.)

Rather than reach into the SSL_SESSION, use the intended API,
SSL_get_servername. This will also help the transition to OpenSSL 1.1.0.

Also don't fill in the tlsTicket field here. This is never read by
oncertcb and was always false anyway; that field is maintained by
clients and tracks whether the server issued a ticket or a session ID.

(Note this is distinct from the copy passed to onclienthello which is
used and is not a no-op.)

@agl
crypto: use SSL_get_servername.
8f4abfc
(Patch by David Benjamin.)
Rather than reach into the SSL_SESSION, use the intended API,
SSL_get_servername. This will also help the transition to OpenSSL 1.1.0.
Also don't fill in the tlsTicket field here. This is never read by
oncertcb and was always false anyway; that field is maintained by
clients and tracks whether the server issued a ticket or a session ID.
(Note this is distinct from the copy passed to onclienthello which is
used and is not a no-op.)
@nodejs-github-botnodejs-github-bot added the c++ Issues and PRs that require attention from people who are familiar with C++. label Oct 28, 2016
@mscdexmscdex added the tls Issues and PRs related to the tls subsystem. label Oct 28, 2016
@mscdex

mscdex commented Oct 28, 2016

Copy link
Copy Markdown
Contributor

/cc @nodejs/crypto

indutny
indutny approved these changes Oct 29, 2016
View reviewed changes

@indutnyindutny left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I've overlooked this during initial commit. Good catch! I guess it is more relevant in 1.1.0

indutny
indutny suggested changes Oct 29, 2016
View reviewed changes

@indutnyindutny left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, one nit before landing.

Comment threadsrc/node_crypto.cc
strlen(sess->tlsext_hostname));
info->Set(env->servername_string(), servername);
}
info->Set(env->tls_ticket_string(),

@indutnyindutnyOct 29, 2016

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On a second thought, we need to remove tls_ticket_string from env.h too, since it is not used anywhere else.

@aglaglOct 30, 2016

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tls_ticket_string is still used in SSLWrap<Base>::OnClientHello. I believe at that point it is meaningful.

The reference to tlsTicket in _tls_wrap.js is to the one set in OnClientHello and should continue to work.

@indutnyindutnyOct 30, 2016

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, gosh. You are right.

@indutny

indutny commented Oct 29, 2016

Copy link
Copy Markdown
Member

One more nit, it looks like tlsTicket is set in some cases after all. This test fails after removing it from _tls_wrap.js:

test/parallel/test-tls-session-cache.js

@indutny

indutny commented Oct 29, 2016

Copy link
Copy Markdown
Member

Just to state it clearly, I withdraw my LGTM for now. Sorry!

indutny
indutny approved these changes Oct 30, 2016
View reviewed changes

@indutnyindutny left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment threadsrc/node_crypto.cc
strlen(sess->tlsext_hostname));
info->Set(env->servername_string(), servername);
}
info->Set(env->tls_ticket_string(),

@indutnyindutnyOct 30, 2016

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, gosh. You are right.

@davidben

davidben commented Nov 9, 2016

Copy link
Copy Markdown
Contributor

Is there anything else left to be done for this PR?

@indutny

indutny commented Nov 9, 2016

Copy link
Copy Markdown
Member

Merging it 😉

@nodejs/crypto any comments before I'll land it?

shigeki
shigeki approved these changes Nov 9, 2016
View reviewed changes

@shigekishigeki left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM after CI is green.

@shigeki

shigeki commented Nov 9, 2016

Copy link
Copy Markdown
Contributor

Running on https://ci.nodejs.org/job/node-test-pull-request/4811/

shigeki pushed a commit that referenced this pull request Nov 9, 2016
@agl@shigeki
crypto: use SSL_get_servername.
305f75a
(Patch by David Benjamin.)
Rather than reach into the SSL_SESSION, use the intended API,
SSL_get_servername. This will also help the transition to OpenSSL 1.1.0.
Also don't fill in the tlsTicket field here. This is never read by
oncertcb and was always false anyway; that field is maintained by
clients and tracks whether the server issued a ticket or a session ID.
(Note this is distinct from the copy passed to onclienthello which is
used and is not a no-op.)
PR-URL: #9347
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
@shigeki

shigeki commented Nov 9, 2016

Copy link
Copy Markdown
Contributor

CI is green except unstable timeout in smartos. Landed in 305f75a. Thanks.

@shigekishigeki closed this Nov 9, 2016
Fishrock123 pushed a commit that referenced this pull request Nov 22, 2016
@agl@Fishrock123
crypto: use SSL_get_servername.
af74db3
(Patch by David Benjamin.)
Rather than reach into the SSL_SESSION, use the intended API,
SSL_get_servername. This will also help the transition to OpenSSL 1.1.0.
Also don't fill in the tlsTicket field here. This is never read by
oncertcb and was always false anyway; that field is maintained by
clients and tracks whether the server issued a ticket or a session ID.
(Note this is distinct from the copy passed to onclienthello which is
used and is not a no-op.)
PR-URL: #9347
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
@MylesBorins

MylesBorins commented Dec 13, 2016

Copy link
Copy Markdown
Contributor

should this be backported?

@bnoordhuis

bnoordhuis commented Dec 19, 2016

Copy link
Copy Markdown
Member

@thealphanerd If it cherry-picks cleanly, sure, why not? If it doesn't, it's fine to leave it out.

MylesBorins pushed a commit that referenced this pull request Dec 21, 2016
@agl@MylesBorins
crypto: use SSL_get_servername.
b8a7b5e
(Patch by David Benjamin.)
Rather than reach into the SSL_SESSION, use the intended API,
SSL_get_servername. This will also help the transition to OpenSSL 1.1.0.
Also don't fill in the tlsTicket field here. This is never read by
oncertcb and was always false anyway; that field is maintained by
clients and tracks whether the server issued a ticket or a session ID.
(Note this is distinct from the copy passed to onclienthello which is
used and is not a no-op.)
PR-URL: #9347
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
MylesBorins pushed a commit that referenced this pull request Dec 21, 2016
@agl@MylesBorins
crypto: use SSL_get_servername.
3c09579
(Patch by David Benjamin.)
Rather than reach into the SSL_SESSION, use the intended API,
SSL_get_servername. This will also help the transition to OpenSSL 1.1.0.
Also don't fill in the tlsTicket field here. This is never read by
oncertcb and was always false anyway; that field is maintained by
clients and tracks whether the server issued a ticket or a session ID.
(Note this is distinct from the copy passed to onclienthello which is
used and is not a no-op.)
PR-URL: #9347
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
MylesBorins pushed a commit that referenced this pull request Dec 21, 2016
@agl@MylesBorins
crypto: use SSL_get_servername.
e2c5f41
(Patch by David Benjamin.)
Rather than reach into the SSL_SESSION, use the intended API,
SSL_get_servername. This will also help the transition to OpenSSL 1.1.0.
Also don't fill in the tlsTicket field here. This is never read by
oncertcb and was always false anyway; that field is maintained by
clients and tracks whether the server issued a ticket or a session ID.
(Note this is distinct from the copy passed to onclienthello which is
used and is not a no-op.)
PR-URL: #9347
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
MylesBorins pushed a commit that referenced this pull request Dec 21, 2016
@agl@MylesBorins
crypto: use SSL_get_servername.
c5a0935
(Patch by David Benjamin.)
Rather than reach into the SSL_SESSION, use the intended API,
SSL_get_servername. This will also help the transition to OpenSSL 1.1.0.
Also don't fill in the tlsTicket field here. This is never read by
oncertcb and was always false anyway; that field is maintained by
clients and tracks whether the server issued a ticket or a session ID.
(Note this is distinct from the copy passed to onclienthello which is
used and is not a no-op.)
PR-URL: #9347
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
MylesBorins pushed a commit that referenced this pull request Dec 21, 2016
@agl@MylesBorins
crypto: use SSL_get_servername.
fd9939f
(Patch by David Benjamin.)
Rather than reach into the SSL_SESSION, use the intended API,
SSL_get_servername. This will also help the transition to OpenSSL 1.1.0.
Also don't fill in the tlsTicket field here. This is never read by
oncertcb and was always false anyway; that field is maintained by
clients and tracks whether the server issued a ticket or a session ID.
(Note this is distinct from the copy passed to onclienthello which is
used and is not a no-op.)
PR-URL: #9347
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
This was referenced Dec 21, 2016
Merged
Merged
@davidbendavidben mentioned this pull request Aug 14, 2017
Closed
2 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bnoordhuisbnoordhuisbnoordhuis approved these changes
+2 more reviewers
@indutnyindutnyindutny approved these changes
@shigekishigekishigeki approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

c++Issues and PRs that require attention from people who are familiar with C++.tlsIssues and PRs related to the tls subsystem.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@agl@mscdex@indutny@davidben@shigeki@MylesBorins@bnoordhuis@nodejs-github-bot