From e23d3e0f45bef94183193f489eb7c20d513c92d3 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Feb 25 2020 15:14:50 +0000 Subject: import rh-nodejs12-nodejs-12.16.1-1.el7 --- diff --git a/.gitignore b/.gitignore index 48f5536..331960c 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/node-v12.14.1-stripped.tar.gz +SOURCES/node-v12.16.1-stripped.tar.gz diff --git a/.rh-nodejs12-nodejs.metadata b/.rh-nodejs12-nodejs.metadata index 49f377f..f6a527f 100644 --- a/.rh-nodejs12-nodejs.metadata +++ b/.rh-nodejs12-nodejs.metadata @@ -1 +1 @@ -6b06eb123f621c1f678c773938134679f7d6e6f4 SOURCES/node-v12.14.1-stripped.tar.gz +696bdce06cf5dc6300d8ef6fc646d45cff401190 SOURCES/node-v12.16.1-stripped.tar.gz diff --git a/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch b/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch index 775b3b5..1c093c9 100644 --- a/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch +++ b/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch @@ -1,34 +1,47 @@ -From fc16538049c634f735da3a40878c18f027004b37 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20Stan=C4=9Bk?= -Date: Thu, 16 Jan 2020 08:48:52 +0100 -Subject: [PATCH 1/4] Remove or backport OpenSSL features -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit +From 7776e056175360b0eaf8e8cd9605671ece0cd66c Mon Sep 17 00:00:00 2001 +From: Zuzana Svetlikova +Date: Wed, 19 Feb 2020 09:33:47 +0000 +Subject: [PATCH 1/4] remove openssl features -Signed-off-by: Jan Staněk --- - doc/api/cli.md | 18 -- + doc/api/cli.md | 26 --- lib/_tls_common.js | 2 +- lib/internal/crypto/keygen.js | 8 +- lib/tls.js | 9 +- + src/env.h | 1 - src/node_constants.cc | 12 +- - src/node_crypto.cc | 482 ++++++++++++++++++++++++++++++++-- - src/node_crypto.h | 42 +++ - src/node_crypto_bio.cc | 29 +- + src/node_crypto.cc | 500 +++++++++++++++++++++++++++++++++++++++--- + src/node_crypto.h | 44 ++++ + src/node_crypto_bio.cc | 29 ++- src/node_errors.h | 4 +- src/node_options.cc | 4 + src/tls_wrap.cc | 2 + - 11 files changed, 548 insertions(+), 64 deletions(-) + 12 files changed, 568 insertions(+), 73 deletions(-) diff --git a/doc/api/cli.md b/doc/api/cli.md -index f9eb87e..89c41de 100644 +index 7703d0b..ecf7632 100644 --- a/doc/api/cli.md +++ b/doc/api/cli.md -@@ -695,14 +695,6 @@ added: v12.0.0 +@@ -706,15 +706,6 @@ added: v4.0.0 + Specify an alternative default TLS cipher list. Requires Node.js to be built + with crypto support (default). + +-### `--tls-keylog=file` +- +- +-Log TLS key material to a file. The key material is in NSS `SSLKEYLOGFILE` +-format and can be used by software (such as Wireshark) to decrypt the TLS +-traffic. +- + ### `--tls-max-v1.2` + + + * `privateKey` {Object | string | Buffer | KeyObject} +- * `dsaEncoding` {string} + * `padding` {integer} + * `saltLength` {integer} + * `outputEncoding` {string} The [encoding][] of the return value. +@@ -1418,10 +1417,6 @@ If `privateKey` is not a [`KeyObject`][], this function behaves as if + `privateKey` had been passed to [`crypto.createPrivateKey()`][]. If it is an + object, the following additional properties can be passed: + +-* `dsaEncoding` {string} For DSA and ECDSA, this option specifies the +- format of the generated signature. It can be one of the following: +- * `'der'` (default): DER-encoded ASN.1 signature structure encoding `(r, s)`. +- * `'ieee-p1363'`: Signature format `r || s` as proposed in IEEE-P1363. + * `padding` {integer} Optional padding value for RSA, one of the following: + * `crypto.constants.RSA_PKCS1_PADDING` (default) + * `crypto.constants.RSA_PKCS1_PSS_PADDING` +@@ -1518,7 +1513,6 @@ changes: + --> + + * `object` {Object | string | Buffer | KeyObject} +- * `dsaEncoding` {string} + * `padding` {integer} + * `saltLength` {integer} + * `signature` {string | Buffer | TypedArray | DataView} +@@ -1532,10 +1526,6 @@ If `object` is not a [`KeyObject`][], this function behaves as if + `object` had been passed to [`crypto.createPublicKey()`][]. If it is an + object, the following additional properties can be passed: + +-* `dsaEncoding` {string} For DSA and ECDSA, this option specifies the +- format of the generated signature. It can be one of the following: +- * `'der'` (default): DER-encoded ASN.1 signature structure encoding `(r, s)`. +- * `'ieee-p1363'`: Signature format `r || s` as proposed in IEEE-P1363. + * `padding` {integer} Optional padding value for RSA, one of the following: + * `crypto.constants.RSA_PKCS1_PADDING` (default) + * `crypto.constants.RSA_PKCS1_PSS_PADDING` +@@ -2427,9 +2417,6 @@ An array of supported digest functions can be retrieved using + +- +-* `line` {Buffer} Line of ASCII text, in NSS `SSLKEYLOGFILE` format. +-* `tlsSocket` {tls.TLSSocket} The `tls.TLSSocket` instance on which it was +- generated. +- +-The `keylog` event is emitted when key material is generated or received by a +-connection managed by this agent (typically before handshake has completed, but +-not necessarily). This keying material can be stored for debugging, as it +-allows captured TLS traffic to be decrypted. It may be emitted multiple times +-for each socket. +- +-A typical use case is to append received lines to a common text file, which is +-later used by software (such as Wireshark) to decrypt the traffic: +- +-```js +-// ... +-https.globalAgent.on('keylog', (line, tlsSocket) => { +- fs.appendFileSync('/tmp/ssl-keys.log', line, { mode: 0o600 }); +-}); +-``` +- + ## Class: `https.Server` + +- +-TLS-PSK support is available as an alternative to normal certificate-based +-authentication. It uses a pre-shared key instead of certificates to +-authenticate a TLS connection, providing mutual authentication. +-TLS-PSK and public key infrastructure are not mutually exclusive. Clients and +-servers can accommodate both, choosing either of them during the normal cipher +-negotiation step. +- +-TLS-PSK is only a good choice where means exist to securely share a +-key with every connecting machine, so it does not replace PKI +-(Public Key Infrastructure) for the majority of TLS uses. +-The TLS-PSK implementation in OpenSSL has seen many security flaws in +-recent years, mostly because it is used only by a minority of applications. +-Please consider all alternative solutions before switching to PSK ciphers. +-Upon generating PSK it is of critical importance to use sufficient entropy as +-discussed in [RFC 4086][]. Deriving a shared secret from a password or other +-low-entropy sources is not secure. +- +-PSK ciphers are disabled by default, and using TLS-PSK thus requires explicitly +-specifying a cipher suite with the `ciphers` option. The list of available +-ciphers can be retrieved via `openssl ciphers -v 'PSK'`. All TLS 1.3 +-ciphers are eligible for PSK but currently only those that use SHA256 digest are +-supported they can be retrieved via `openssl ciphers -v -s -tls1_3 -psk`. +- +-According to the [RFC 4279][], PSK identities up to 128 bytes in length and +-PSKs up to 64 bytes in length must be supported. As of OpenSSL 1.1.0 +-maximum identity size is 128 bytes, and maximum PSK length is 256 bytes. +- +-The current implementation doesn't support asynchronous PSK callbacks due to the +-limitations of the underlying OpenSSL API. +- + ### Client-initiated renegotiation attack mitigation + + +@@ -861,27 +827,16 @@ changes: + pr-url: https://github.com/nodejs/node/pull/26625 + description: Return the minimum cipher version, instead of a fixed string + (`'TLSv1/SSLv3'`). +- - version: v12.16.0 +- pr-url: https://github.com/nodejs/node/pull/30637 +- description: Return the IETF cipher name as `standardName`. + --> + + * Returns: {Object} +- * `name` {string} OpenSSL name for the cipher suite. +- * `standardName` {string} IETF name for the cipher suite. ++ * `name` {string} The name of the cipher suite. + * `version` {string} The minimum TLS protocol version supported by this cipher + suite. + + Returns an object containing information on the negotiated cipher suite. + +-For example: +-```json +-{ +- "name": "AES128-SHA256", +- "standardName": "TLS_RSA_WITH_AES_128_CBC_SHA256", +- "version": "TLSv1.2" +-} +-``` ++For example: `{ name: 'AES256-SHA', version: 'TLSv1.2' }`. + + See + [SSL_CIPHER_get_name](https://www.openssl.org/docs/man1.1.1/man3/SSL_CIPHER_get_name.html) +@@ -1082,18 +1037,6 @@ See [Session Resumption][] for more information. + Note: `getSession()` works only for TLSv1.2 and below. For TLSv1.3, applications + must use the [`'session'`][] event (it also works for TLSv1.2 and below). + +-### `tlsSocket.getSharedSigalgs()` +- +- +-* Returns: {Array} List of signature algorithms shared between the server and +-the client in the order of decreasing preference. +- +-See +-[SSL_get_shared_sigalgs](https://www.openssl.org/docs/man1.1.1/man3/SSL_get_shared_sigalgs.html) +-for more information. +- + ### `tlsSocket.getTLSTicket()` + + +-Set [`tls.DEFAULT_MAX_VERSION`][] to 'TLSv1.2'. Use to disable support for +-TLSv1.3. ++Set [`tls.DEFAULT_MAX_VERSION`][] to 'TLSv1.2'. + + ### `--tls-min-v1.0` +