File fix_build_with_openssl_1.1.1d.patch of Package nodejs10

Overview Repositories Revisions Requests Users Attributes Meta

File fix_build_with_openssl_1.1.1d.patch of Package nodejs10 (Revision c26d563062e5d43b57f33217f313f81f)

Currently displaying revision c26d563062e5d43b57f33217f313f81f , Show latest

From 7dc56e082b96aeee34e83dabbad81ee12607e38f Mon Sep 17 00:00:00 2001
From: Sam Roberts <vieuxtech@gmail.com>
Date: Fri, 13 Sep 2019 13:19:06 -0700
Subject: [PATCH] test: well-defined DH groups now verify clean

OpenSSL 1.1.1d no longer generates warnings for some DH groups that used
to be considered unsafe. See below for discussion. This is considered a
bug fix.

See:
- https://github.com/openssl/openssl/pull/9363
- https://github.com/openssl/openssl/pull/9363#discussion_r324802618
---
 test/parallel/test-crypto-binary-default.js |  3 +--
 test/parallel/test-crypto-dh.js             | 28 +++++++++++++--------
 2 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/test/parallel/test-crypto-binary-default.js b/test/parallel/test-crypto-binary-default.js
index c96253bc44d4..bbf327e78992 100644
--- a/test/parallel/test-crypto-binary-default.js
+++ b/test/parallel/test-crypto-binary-default.js
@@ -36,7 +36,6 @@ const crypto = require('crypto');
 const fs = require('fs');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const DH_NOT_SUITABLE_GENERATOR = crypto.constants.DH_NOT_SUITABLE_GENERATOR;
 
 require('internal/crypto/util').setDefaultEncoding('latin1');
 
@@ -616,7 +615,7 @@ common.expectsError(
             '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' +
             'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF';
   const d = crypto.createDiffieHellman(p, 'hex');
-  assert.strictEqual(d.verifyError, DH_NOT_SUITABLE_GENERATOR);
+  assert.strictEqual(d.verifyError, 0);
 
   // Test RSA key signing/verification
   const rsaSign = crypto.createSign('SHA1');
diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
index 1fc8564ca16f..2d55ae756482 100644
--- a/test/parallel/test-crypto-dh.js
+++ b/test/parallel/test-crypto-dh.js
@@ -6,6 +6,8 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 
+const DH_CHECK_P_NOT_PRIME = crypto.constants.DH_CHECK_P_NOT_PRIME;
+const DH_CHECK_P_NOT_SAFE_PRIME = crypto.constants.DH_CHECK_P_NOT_SAFE_PRIME;
 const DH_NOT_SUITABLE_GENERATOR = crypto.constants.DH_NOT_SUITABLE_GENERATOR;
 
 // Test Diffie-Hellman with two parties sharing a secret,
@@ -126,8 +128,8 @@ bob.generateKeys();
 const aSecret = alice.computeSecret(bob.getPublicKey()).toString('hex');
 const bSecret = bob.computeSecret(alice.getPublicKey()).toString('hex');
 assert.strictEqual(aSecret, bSecret);
-assert.strictEqual(alice.verifyError, DH_NOT_SUITABLE_GENERATOR);
-assert.strictEqual(bob.verifyError, DH_NOT_SUITABLE_GENERATOR);
+assert.strictEqual(alice.verifyError, 0);
+assert.strictEqual(bob.verifyError, 0);
 
 /* Ensure specific generator (buffer) works as expected.
  * The values below (modp2/modp2buf) are for a 1024 bits long prime from
@@ -158,8 +160,8 @@ const modp2buf = Buffer.from([
   const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
       .toString('hex');
   assert.strictEqual(modp2Secret, exmodp2Secret);
-  assert.strictEqual(modp2.verifyError, DH_NOT_SUITABLE_GENERATOR);
-  assert.strictEqual(exmodp2.verifyError, DH_NOT_SUITABLE_GENERATOR);
+  assert.strictEqual(modp2.verifyError, 0);
+  assert.strictEqual(exmodp2.verifyError, 0);
 }
 
 for (const buf of [modp2buf, ...common.getArrayBufferViews(modp2buf)]) {
@@ -172,7 +174,7 @@ for (const buf of [modp2buf, ...common.getArrayBufferViews(modp2buf)]) {
   const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
       .toString('hex');
   assert.strictEqual(modp2Secret, exmodp2Secret);
-  assert.strictEqual(exmodp2.verifyError, DH_NOT_SUITABLE_GENERATOR);
+  assert.strictEqual(exmodp2.verifyError, 0);
 }
 
 {
@@ -184,7 +186,7 @@ for (const buf of [modp2buf, ...common.getArrayBufferViews(modp2buf)]) {
   const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
       .toString('hex');
   assert.strictEqual(modp2Secret, exmodp2Secret);
-  assert.strictEqual(exmodp2.verifyError, DH_NOT_SUITABLE_GENERATOR);
+  assert.strictEqual(exmodp2.verifyError, 0);
 }
 
 {
@@ -196,17 +198,23 @@ for (const buf of [modp2buf, ...common.getArrayBufferViews(modp2buf)]) {
   const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
       .toString('hex');
   assert.strictEqual(modp2Secret, exmodp2Secret);
-  assert.strictEqual(exmodp2.verifyError, DH_NOT_SUITABLE_GENERATOR);
+  assert.strictEqual(exmodp2.verifyError, 0);
 }
 
-
+// Second OAKLEY group, see
+// https://github.com/nodejs/node-v0.x-archive/issues/2338 and
+// https://xml2rfc.tools.ietf.org/public/rfc/html/rfc2412.html#anchor49
 const p = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' +
           '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' +
           '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' +
           'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF';
-const bad_dh = crypto.createDiffieHellman(p, 'hex');
-assert.strictEqual(bad_dh.verifyError, DH_NOT_SUITABLE_GENERATOR);
+const dh = crypto.createDiffieHellman(p, 'hex');
+assert.strictEqual(dh.verifyError, 0);
 
+// Confirm DH_check() results are exposed for optional examination.
+const bad_dh = crypto.createDiffieHellman('02', 'hex');
+assert.strictEqual(bad_dh.verifyError, DH_CHECK_P_NOT_PRIME |
+                   DH_CHECK_P_NOT_SAFE_PRIME | DH_NOT_SUITABLE_GENERATOR);
 
 const availableCurves = new Set(crypto.getCurves());
 const availableHashes = new Set(crypto.getHashes());

Places

File fix_build_with_openssl_1.1.1d.patch of Package nodejs10 (Revision c26d563062e5d43b57f33217f313f81f)

Places