Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto: disable ssl compression at build time #6582

Merged
merged 5 commits into from
May 5, 2016
Merged

crypto: disable ssl compression at build time #6582

merged 5 commits into from
May 5, 2016

Commits on May 4, 2016

  1. crypto: disable ssl compression at build time 

    SSL compression was first disabled at runtime in March 2011 in commit
e83c695 ("Disable compression with OpenSSL.") for performance reasons
and was later shown to be vulnerable to information leakage (CRIME.)
Let's stop compiling it in altogether.

This commit removes a broken CHECK from src/node_crypto.cc; broken
because sk_SSL_COMP_num() returns -1 for a NULL stack, not 0.  As a
result, node.js would abort when linked to an OPENSSL_NO_COMP build
of openssl.

PR-URL: nodejs#6582
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
    @bnoordhuis
    bnoordhuis committed May 4, 2016
    Configuration menu
    Copy the full SHA
    e6b35f4 View commit details
    Browse the repository at this point in the history

  2. src: remove pre-openssl 1.0 legacy code 

    SSL_CIPHER and SSL_METHOD are always const with the version of openssl
that we support, no need to check OPENSSL_VERSION_NUMBER first.

PR-URL: nodejs#6582
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
    @bnoordhuis
    bnoordhuis committed May 4, 2016
    Configuration menu
    Copy the full SHA
    b261178 View commit details
    Browse the repository at this point in the history

  3. src: remove unused #include statement 

    strcasecmp() is not used in src/node_http_parser.cc so there is no need
to include its header file.

PR-URL: nodejs#6582
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
    @bnoordhuis
    bnoordhuis committed May 4, 2016
    Configuration menu
    Copy the full SHA
    6db772d View commit details
    Browse the repository at this point in the history

  4. src: don't use locale-sensitive strcasecmp() 

    strcasecmp() is affected by the current locale as configured through
e.g. the LC_ALL environment variable and the setlocale() libc function.

It can result in unpredictable results across systems so replace it with
a function that isn't susceptible to that.

PR-URL: nodejs#6582
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
    @bnoordhuis
    bnoordhuis committed May 4, 2016
    Configuration menu
    Copy the full SHA
    f6940df View commit details
    Browse the repository at this point in the history

  5. deps: update comment about PURIFY define 

    PURIFY makes OpenSSL zero out some buffers.  It also stops RAND_bytes()
from using the existing contents of the destination buffer as a source
of entropy, which according to some papers, is a possible attack vector
for reducing the overall entropy.

PR-URL: nodejs#6582
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
    @bnoordhuis
    bnoordhuis committed May 4, 2016
    Configuration menu
    Copy the full SHA
    a4f94b4 View commit details
    Browse the repository at this point in the history