deps: upgrade OpenSSL to version 1.0.2l

[danbev]

This pull request contains commits to upgrade OpenSSL to version 1.0.2.l

This includes commits following the instructions in Upgrading OpenSSL, and also reverts f439065 as mentioned in #13161.

Fixes: #13161

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• commit message follows commit guidelines

Affected core subsystem(s)

deps, crypto

[mscdex]

Are these changes necessary?

[danbev]

I was not sure and thought it would be better to be safe than sorry and get feedback on the PR first. Let me know and I'll remove that commit. Thanks

[shigeki]

OpenSSL Configure generates this whitespace but it is always removed with git am --whitespace=fix. So we can left it as it will be removed.

[mscdex]

/cc @nodejs/crypto

[danbev]

CI: https://ci.nodejs.org/job/node-test-pull-request/8316/

[danbev]

test/osx failure looks unrelated

console output:

not ok 457 parallel/test-http-1.0-keep-alive
  ---
  duration_ms: 6.478
  severity: crashed
  stack: |-
    oh no!
    exit code: CRASHED (Signal: 9)
  ...
not ok 458 parallel/test-http-abort-before-end
  ---
  duration_ms: 6.475
  severity: crashed
  stack: |-
    oh no!
    exit code: CRASHED (Signal: 9)
  ...

[shigeki]

It seems asm files are not updated. Did you run https://github.com/nodejs/node/blob/master/deps/openssl/doc/UPGRADING.md#6-asm-files-for-openssl?

[danbev]

It seems asm files are not updated. Did you run

I actually did not run them, will do that now. For some reason I though there was no need to have them updated but looking closer I realise there are changes to them. About the versions of gcc and nasm, do these have to be exact matches or are later version also alright?

[danbev]

Regenerate asm files with Makefile and CC=gcc and ASM=gcc where gcc-4.8.4.

@shigeki Should the commit message be ASM=nasm here instead or is the above correct?

[danbev]

CI: https://ci.nodejs.org/job/node-test-pull-request/8327/

[shigeki]

Regenerate asm files with Makefile and CC=gcc and ASM=gcc where gcc-4.8.4.
@shigeki Should the commit message be ASM=nasm here instead or is the above correct?

@danbev ASM=nasm is the right one. I mistook the word in that commit message.
I checked the asm updates of 8561e192173b4df66f941c07a0cc0a4748eea1a9 and found that something wrong in checking nasm version with ASM env. Could you give me an output of nasm -v?

[danbev]

ASM=nasm is the right one. I mistook the word in that commit message.

Great, I used that in the commit message and also added the version of nasm being used. If you think this looks good I can update step 6.3.

Could you give me an output of nasm -v?

$ nasm -v
NASM version 2.11.06 compiled on Nov  4 2014

[shigeki]

@danbev Sorry, I should have ask you about your CC environment not ASM. It seems that your commit of updating asm files in 8561e192173b4df66f941c07a0cc0a4748eea1a9 failed to check the avx version of https://github.com/nodejs/node/blob/master/deps/openssl/openssl/crypto/aes/asm/aesni-mb-x86_64.pl#L51-L54. I requires that gas version above 2.22, which is $avx == 2 on Linux to regenerate asm files.

This is my output gas version.

$ $CC -Wa,-v -c -o /dev/null -x assembler /dev/null
GNU assembler version 2.26.1 (x86_64-linux-gnu) using BFD version (GNU Binutils for Ubuntu) 2.26.1

What is yours?

[shigeki]

@danbev shigeki@aaa09eb is my asm updates on upgrading 1.0.2l. If it have any difference with yours, there is something wrong between your env and mine.

[danbev]

What is yours?

$ $CC -Wa,-v -c -o /dev/null -x assembler /dev/null
Apple LLVM version 8.0.0 (clang-800.0.42.1)
Target: x86_64-apple-darwin15.6.0
Thread model: posix
InstalledDir: /Library/Developer/CommandLineTools/usr/bin
 "/Library/Developer/CommandLineTools/usr/bin/clang" -cc1as -triple x86_64-apple-macosx10.11.0 -filetype obj -main-file-name null -target-cpu core2 -fdebug-compilation-dir /Users/danielbevenius/work/nodejs/node/deps/openssl -dwarf-debug-producer Apple LLVM version 8.0.0 (clang-800.0.42.1) -dwarf-version=2 -mrelocation-model pic -o /dev/null /dev/null

My $CC version is:

$ $CC --version
gcc-4.8 (Homebrew gcc48 4.8.3) 4.8.3
Copyright (C) 2013 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Sorry if I misunderstood the docs, the example does show using linux but does this have to be done on Linux?

[shigeki]

I've got it. The upgrading doc is only for Linux. I tried to run on MacOS but it failed. I did not investigate it further. You can fix it to work it on MacOS or re-update it on Linux.

[danbev]

I've got it. The upgrading doc is only for Linux. I tried to run on MacOS but it failed. I did not investigate it further. You can fix it to work it on MacOS or re-update it on Linux.

I'll take a look and see if I can get this working on MacOS, otherwise I'll re-update it on Linux. Thanks

[danbev]

@shigeki I built this on Linux as I was not able to get it work properly on MacOS. Could you take a look, I'm a little concerned that I have a bunch or deletes in asm_obsolete that were not in your example commit. Did I miss something?

I was wondering about these steps:

ohtsu@ubuntu:~/github/node/deps/openssl/asm$ cd ../asm_obsolete/
ohtsu@ubuntu:~/github/node/deps/openssl/asm_obsolete$ unset CC
ohtsu@ubuntu:~/github/node/deps/openssl/asm_obsolete$ unset ASM
ohtsu@ubuntu:~/github/node/deps/openssl/asm_obsolete$ make clean
find . -iname '*.asm' -exec rm "{}" \;
find . -iname '*.s' -exec rm "{}" \;
find . -iname '*.S' -exec rm "{}" \;
ohtsu@ubuntu:~/github/node/deps/openssl$ git status

We do a make clean but it is not followed by a make, is that correct? I did not do a make as I'm following the doc but wanted to double check that I did not miss a command here. Thanks

[shigeki]

@danbev You are right. It was missed in the doc that

ohtsu@ubuntu:~/github/node/deps/openssl/asm_obsolete$ make

after make clean in order to generate asm files in case of no CC and ASM envs.

Could you update asm files in the asm_obsolete dir and also add the commit to fix UPGRADING.md?

[danbev]

Could you update asm files in the asm_obsolete dir and also add the commit to fix UPGRADING.md?

@shigeki I've updated now and also rebased, plus added an additional commit for UPGRADING.md. Let me know what you think, thanks!

[danbev]

Rebased CI: https://ci.nodejs.org/job/node-test-pull-request/8376/

[shigeki]

Everything is fine. Thanks for your work.
I will land this later to see if anyone puts another approvals.

[danbev]

@shigeki Thanks for your help and your patience on this!

[mhdawson]

Rubber stamp LGTM.

[shigeki]

@danbev I've just found one issue in this PR.
You added 12f61e94f8c396d1aeda73aaac65d2e10b954416 to reverted the floating patch but the revert fix was applied after replacing openssl sources so that it reverts original openssl source fix.
It is needed to revert the floating patch before replacing openssl sources or just leave it without reverting. I think the latter is simple. Please remove 12f61e94f8c396d1aeda73aaac65d2e10b954416.