e52ec44229This changes enables compression within OpenSSL *without* enabling record compression, so this only affects compression of certificates delivered within the TLS handshake. This certificate compression remains disabled by default for now, but becomes available via the new certificateCompression option in TLS context APIs. Enabling this shrinks handshakes significantly, and also reduces fingerprintability of Node.js client handshakes, as these are enabled in all modern browsers by default. Signed-off-by: Tim Perry <pimterry@gmail.com> PR-URL: https://github.com/nodejs/node/pull/62217 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> |
||
|---|---|---|
| .. | ||
| config | ||
| openssl | ||
| .gitignore | ||
| BUILD.gn | ||
| nodejs-openssl.cnf | ||
| openssl-cl_asm.gypi | ||
| openssl-cl_asm_avx2.gypi | ||
| openssl-cl_no_asm.gypi | ||
| openssl-cli.gypi | ||
| openssl-fips_asm.gypi | ||
| openssl-fips_asm_avx2.gypi | ||
| openssl-fips_no_asm.gypi | ||
| openssl.gyp | ||
| openssl.gypi | ||
| openssl_asm.gypi | ||
| openssl_asm_avx2.gypi | ||
| openssl_common.gypi | ||
| openssl_no_asm.gypi | ||
| README.md | ||
| unofficial.gni | ||
This has a new binding scheme in building OpenSSL-3.0.0 library with
Node.js. OpenSSL-3.0.0 uses a new build system with Perl for various
supported platforms. See openssl/Configurations/README and
openssl/Configurations/README-design.md in the OpenSSL source for
details.
In order to build OpenSSL library without Perl in the build of Node.js
for various supported platforms, platform dependent files (e.g. asm
and header files ) are pre-generated and stored into the
config/archs directory.
-
config/Makefileandconfig/generate_gypi.plMakefile has supported platform list and generates and copies platform dependent files (e.g. asm files) into arch directory with
generate_gypi.pl. Platform dependent gypi files are also created obtaining build information fromconfigdata.pmthat is generated withConfigurein the OpenSSL build system.For Windows,
Configuregeneratesmakefilethat is only available tonmakecommand.config/Makefile_VC-WIN32andconfig/Makefile_VC-WIN64Aare made by hand for the use of GNU make. Ifmakefilerules or targets are changed in the version up of OpenSSL, they should be also updated. -
gyp and gypi files (
openssl*.{gyp,gypi})openssl.gyphas two targets of openssl and openssl-cli referred fromnode.gyp. They include asm and no_asm gypi files with arch dependent gypi according to its build options and platforms. The gyp data which is common with asm and no_asm are stored inopenssl_common.gypi. -
header files (
config/*.{h,h.tmpl})bn_conf.h,dso_conf.handopensslconf.hare platform dependent in the OpenSSL sources. They are replaced withconfig/*.h.tmplfiles to include the file in the../../../config/and referred to each arch file that depends on asm and no-asm option. These headers are generated by the make targetgenerate_headers.
Supported architectures for use of ASM
Here is a list of supported architectures for use of ASM in OpenSSL.
| --dest-os | --dest-cpu | OpenSSL target arch | CI |
|---|---|---|---|
| aix | ppc64 | aix64-gcc | o |
| linux | ia32 | linux-elf | o |
| linux | x32 | linux-x32 | - |
| linux | x64 | linux-x86_64 | o |
| linux | arm | linux-armv4 | o |
| linux | arm64 | linux-aarch64 | o |
| linux | ppc64(*1) | linux-ppc64le | o |
| linux | s390 | linux32-s390x | o |
| linux | s390x | linux64-s390x | o |
| mac | ia32 | darwin-i386-cc | - |
| mac | x64 | darwin64-x86-cc | o |
| win | ia32 | VC-WIN32 | - |
| win | x64 | VC-WIN64A | o |
| solaris | ia32 | solaris-x86-gcc | o |
| solaris | x64 | solaris64-x86_64-gcc | o |
| freebsd | ia32 | BSD-x86 | - |
| freebsd | x64 | BSD-x86_64 | o |
| openbsd | ia32 | BSD-x86 | - |
| openbsd | x64 | BSD-x86_64 | - |
| others | others | linux-elf | - |
(*1: This needs to be configured with the variable of node_byteorder: little)
These are listed in config/Makefile. Please refer config/opensslconf_asm.h for details.
To remove or add an architecture the templates need to be updated for which there are two:
- include_asm.h.tmpl
- include_no-asm.h.tmpl
Remove the architecture in question from these files and then run:
$ make generate-headers
Also remove the architecture from the list of supported ASM architectures in README.md
Upgrading OpenSSL
Please refer to maintaining-openssl.