delta/node-new.git/src/node_crypto.cc, branch pull-request-doc-updates

src: fix data type in node_crypto.cc

2019-02-06T04:26:50+00:00

Signed-off-by: gengjiawen 

PR-URL: https://github.com/nodejs/node/pull/25889
Reviewed-By: Anna Henningsen 
Reviewed-By: Daniel Bevenius 
Reviewed-By: Colin Ihrig 
Reviewed-By: James M Snell

tls: in-line comments and other cleanups

2019-02-05T23:17:53+00:00

PR-URL: https://github.com/nodejs/node/pull/25861
Reviewed-By: Fedor Indutny 
Reviewed-By: Anna Henningsen

crypto: don't crash X509ToObject on error

2019-02-05T06:28:09+00:00

Use MaybeLocal::ToLocal and don't crash X509ToObject on error.

PR-URL: https://github.com/nodejs/node/pull/25717
Reviewed-By: James M Snell 
Reviewed-By: Anna Henningsen

crypto: fix malloc mixing in X509ToObject

2019-02-05T06:17:37+00:00

EC_KEY_key2buf returns an OPENSSL_malloc'd pointer so it shouldn't be
passed into Buffer::New, which expect a libc malloc'd pointer. Instead,
factor out the ECDH::GetPublicKey code which uses EC_POINT_point2oct.

This preserves the existing behavior where encoding failures are
silently ignored, but it is probably safe to CHECK fail them instead.

PR-URL: https://github.com/nodejs/node/pull/25717
Reviewed-By: James M Snell 
Reviewed-By: Anna Henningsen

tls: introduce client 'session' event

2019-02-02T03:06:58+00:00

OpenSSL has supported async notification of sessions and tickets since
1.1.0 using SSL_CTX_sess_set_new_cb(), for all versions of TLS. Using
the async API is optional for TLS1.2 and below, but for TLS1.3 it will
be mandatory. Future-proof applications should start to use async
notification immediately. In the future, for TLS1.3, applications that
don't use the async API will silently, but gracefully, fail to resume
sessions and instead do a full handshake.

See: https://wiki.openssl.org/index.php/TLS1.3#Sessions

PR-URL: https://github.com/nodejs/node/pull/25831
Reviewed-By: Anna Henningsen 
Reviewed-By: Fedor Indutny

crypto: fix public key encoding name in comment

2019-02-01T09:45:20+00:00

PKCS#8 describes an encoding for private keys, not public keys. Using
the name as a format usually refers to the PrivateKeyInfo structure it
defines. (Or sometimes the EncryptedPrivateKeyInfo variant or the
little-used OneAsymmetricKey extension defined in RFC 5958.) None of
these structures can hold public keys to begin with.

d2i_PUBKEY actually parses the public key analogous format defined in
X.509, SubjectPublicKeyInfo. This function already uses "X.509" to refer
to an entire certificate, so say SubjectPublicKeyInfo in the comment.

(The abbreviation SPKI sometimes refers to SubjectPublicKeyInfo, e.g. in
RFC 7469, but it can also an alternate S-expression-based PKI to X.509,
Simple Public Key Infrastructure. To avoid confusion, stick with the
expanded name.)

PR-URL: https://github.com/nodejs/node/pull/25736
Reviewed-By: Sam Roberts 
Reviewed-By: James M Snell

src: pass along errors from KeyObject instantiation

2019-01-29T19:02:03+00:00

PR-URL: https://github.com/nodejs/node/pull/25734
Reviewed-By: James M Snell 
Reviewed-By: Gus Caplan

tls: fix malloc mismatch in SSL_set_tlsext_status_ocsp_resp call

2019-01-29T16:10:34+00:00

SSL_set_tlsext_status_ocsp_resp expects the data to be allocated with
OPENSSL_malloc, not libc malloc, so use OpenSSLMalloc.

Additionally, though OpenSSL doesn't type-check due to it being a macro,
the function is documented to take an unsigned char pointer:
https://www.openssl.org/docs/man1.1.0/ssl/SSL_set_tlsext_status_ocsp_resp.html

(By default, OPENSSL_malloc is the same as libc malloc, but it is
possible to customize this.)

PR-URL: https://github.com/nodejs/node/pull/25706
Reviewed-By: Sam Roberts 
Reviewed-By: Ali Ijaz Sheikh 
Reviewed-By: Anna Henningsen 
Reviewed-By: James M Snell

src: in-source comments and minor TLS cleanups

2019-01-28T23:27:42+00:00

Renamed some internal C++ methods and properties for consistency, and
commented SSL I/O.

- Rename waiting_new_session_ after is_waiting_new_session(), instead of
  using reverse naming (new_session_wait_), and change "waiting" to
  "awaiting".
- Make TLSWrap::ClearIn() return void, the value is never used.
- Fix a getTicketKeys() cut-n-paste error. Since it doesn't use the
  arguments, remove them from the js wrapper.
- Remove call of setTicketKeys(getTicketKeys()), its a no-op.

PR-URL: https://github.com/nodejs/node/pull/25713
Reviewed-By: Anna Henningsen 
Reviewed-By: Michael Dawson 
Reviewed-By: Ben Noordhuis

tls: make ossl 1.1.1 cipher list throw error

2019-01-22T21:34:01+00:00

Make OpenSSL 1.1.1 error during cipher list setting if it would have
errored with OpenSSL 1.1.0.

Can be dropped after our OpenSSL fixes this upstream.

See: https://github.com/openssl/openssl/pull/7759

PR-URL: https://github.com/nodejs/node/pull/25381
Reviewed-By: Daniel Bevenius 
Reviewed-By: Shigeki Ohtsu