Skip to content

Commit b7d557b

Browse files
pimterrypimterry
committed
tls: add certificateCompression option
This changes enables compression within OpenSSL *without* enabling record compression, so this only affects compression of certificates delivered within the TLS handshake. This certificate compression remains disabled by default for now, but becomes available via the new certificateCompression option in TLS context APIs. Enabling this shrinks handshakes significantly, and also reduces fingerprintability of Node.js client handshakes, as these are enabled in all modern browsers by default.
1 parent 2b74812 commit b7d557b

File tree

357 files changed

+8796
-2710
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

357 files changed

+8796
-2710
lines changed

‎deps/openssl/config/Makefile‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,17 @@ CC = gcc
2121
FAKE_GCC = ../config/fake_gcc.pl
2222

2323
CONFIGURE = ./Configure
24-
# no-comp: against CRIME attack
2524
# no-shared: openssl-cli needs static link
2625
# no-afalgeng: old Linux kernel < 4.0 does not support it
2726
# enable-ssl-trace: cause the optional SSL_trace API to be built
28-
COPTS = no-comp no-shared no-afalgeng enable-ssl-trace enable-fips
27+
# zlib/brotli/zstd: enable compression libraries for TLS certificate
28+
# compression (RFC 8879). Record compression remains disabled at runtime
29+
# via SSL_OP_NO_COMPRESSION and sk_SSL_COMP_zero() in crypto_util.cc.
30+
# Include paths point to Node's bundled deps (relative to openssl/).
31+
COPTS = no-shared no-afalgeng enable-ssl-trace enable-fips \
32+
zlib --with-zlib-include=../../zlib \
33+
enable-brotli --with-brotli-include=../../brotli/c/include \
34+
enable-zstd --with-zstd-include=../../zstd/lib
2935

3036
# disable platform check in Configure
3137
NO_WARN_ENV = CONFIGURE_CHECKER_WARN=1

‎deps/openssl/config/archs/BSD-x86/asm/configdata.pm‎

Lines changed: 95 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ our %config = (
112112
"crypto/dso/build.info",
113113
"crypto/engine/build.info",
114114
"crypto/err/build.info",
115+
"crypto/comp/build.info",
115116
"crypto/http/build.info",
116117
"crypto/ocsp/build.info",
117118
"crypto/cms/build.info",
@@ -189,9 +190,7 @@ our %config = (
189190
"OPENSSL_THREADS",
190191
"OPENSSL_NO_AFALGENG",
191192
"OPENSSL_NO_ASAN",
192-
"OPENSSL_NO_BROTLI",
193193
"OPENSSL_NO_BROTLI_DYNAMIC",
194-
"OPENSSL_NO_COMP",
195194
"OPENSSL_NO_CRYPTO_MDEBUG",
196195
"OPENSSL_NO_CRYPTO_MDEBUG_BACKTRACE",
197196
"OPENSSL_NO_DEMOS",
@@ -221,9 +220,7 @@ our %config = (
221220
"OPENSSL_NO_UPLINK",
222221
"OPENSSL_NO_WEAK_SSL_CIPHERS",
223222
"OPENSSL_NO_WINSTORE",
224-
"OPENSSL_NO_ZLIB",
225223
"OPENSSL_NO_ZLIB_DYNAMIC",
226-
"OPENSSL_NO_ZSTD",
227224
"OPENSSL_NO_ZSTD_DYNAMIC",
228225
"OPENSSL_NO_DYNAMIC_ENGINE"
229226
],
@@ -232,17 +229,22 @@ our %config = (
232229
],
233230
"openssl_sys_defines" => [],
234231
"openssldir" => "",
235-
"options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-brotli no-brotli-dynamic no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib no-zlib-dynamic no-zstd no-zstd-dynamic",
232+
"options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
236233
"patch" => "5",
237234
"perl_archname" => "x86_64-linux-gnu-thread-multi",
238235
"perl_cmd" => "/usr/bin/perl",
239236
"perl_version" => "5.34.0",
240237
"perlargv" => [
241-
"no-comp",
242238
"no-shared",
243239
"no-afalgeng",
244240
"enable-ssl-trace",
245241
"enable-fips",
242+
"zlib",
243+
"--with-zlib-include=../../zlib",
244+
"enable-brotli",
245+
"--with-brotli-include=../../brotli/c/include",
246+
"enable-zstd",
247+
"--with-zstd-include=../../zstd/lib",
246248
"BSD-x86"
247249
],
248250
"perlenv" => {
@@ -320,16 +322,23 @@ our %target = (
320322
"cflags" => "-pthread",
321323
"cppflags" => "-D_THREAD_SAFE -D_REENTRANT",
322324
"defines" => [
323-
"OPENSSL_BUILDING_OPENSSL"
325+
"OPENSSL_BUILDING_OPENSSL",
326+
"BROTLI",
327+
"ZLIB",
328+
"ZSTD"
324329
],
325330
"disable" => [],
326331
"dso_ldflags" => "-Wl,-z,defs",
327332
"dso_scheme" => "dlfcn",
328333
"enable" => [
329334
"devcryptoeng"
330335
],
331-
"ex_libs" => "-pthread",
332-
"includes" => [],
336+
"ex_libs" => "-lz -lbrotlienc -lbrotlidec -lbrotlicommon -lm -lzstd -pthread",
337+
"includes" => [
338+
"../../brotli/c/include",
339+
"../../zlib",
340+
"../../zstd/lib"
341+
],
333342
"lflags" => "",
334343
"lib_cflags" => "",
335344
"lib_cppflags" => "-DL_ENDIAN",
@@ -507,10 +516,8 @@ our @disablables_int = (
507516
our %disabled = (
508517
"afalgeng" => "option",
509518
"asan" => "default",
510-
"brotli" => "default",
511519
"brotli-dynamic" => "default",
512520
"buildtest-c++" => "default",
513-
"comp" => "option",
514521
"crypto-mdebug" => "default",
515522
"crypto-mdebug-backtrace" => "default",
516523
"demos" => "default",
@@ -542,12 +549,14 @@ our %disabled = (
542549
"uplink" => "no uplink_arch",
543550
"weak-ssl-ciphers" => "default",
544551
"winstore" => "not-windows",
545-
"zlib" => "default",
546552
"zlib-dynamic" => "default",
547-
"zstd" => "default",
548553
"zstd-dynamic" => "default"
549554
);
550-
our %withargs = ();
555+
our %withargs = (
556+
"brotli_include" => "../../brotli/c/include",
557+
"zlib_include" => "../../zlib",
558+
"zstd_include" => "../../zstd/lib"
559+
);
551560
our %unified_info = (
552561
"attributes" => {
553562
"depends" => {
@@ -1035,6 +1044,9 @@ our %unified_info = (
10351044
"test/bio_callback_test" => {
10361045
"noinst" => "1"
10371046
},
1047+
"test/bio_comp_test" => {
1048+
"noinst" => "1"
1049+
},
10381050
"test/bio_core_test" => {
10391051
"noinst" => "1"
10401052
},
@@ -1302,6 +1314,9 @@ our %unified_info = (
13021314
"test/casttest" => {
13031315
"noinst" => "1"
13041316
},
1317+
"test/cert_comp_test" => {
1318+
"noinst" => "1"
1319+
},
13051320
"test/chacha_internal_test" => {
13061321
"noinst" => "1"
13071322
},
@@ -8362,6 +8377,10 @@ our %unified_info = (
83628377
"libcrypto",
83638378
"test/libtestutil.a"
83648379
],
8380+
"test/bio_comp_test" => [
8381+
"libcrypto.a",
8382+
"test/libtestutil.a"
8383+
],
83658384
"test/bio_core_test" => [
83668385
"libcrypto",
83678386
"test/libtestutil.a"
@@ -10124,6 +10143,20 @@ our %unified_info = (
1012410143
]
1012510144
}
1012610145
},
10146+
"crypto/comp" => {
10147+
"deps" => [
10148+
"crypto/comp/libcrypto-lib-c_brotli.o",
10149+
"crypto/comp/libcrypto-lib-c_zlib.o",
10150+
"crypto/comp/libcrypto-lib-c_zstd.o",
10151+
"crypto/comp/libcrypto-lib-comp_err.o",
10152+
"crypto/comp/libcrypto-lib-comp_lib.o"
10153+
],
10154+
"products" => {
10155+
"lib" => [
10156+
"libcrypto"
10157+
]
10158+
}
10159+
},
1012710160
"crypto/conf" => {
1012810161
"deps" => [
1012910162
"crypto/conf/libcrypto-lib-conf_api.o",
@@ -12086,6 +12119,7 @@ our %unified_info = (
1208612119
"test/helpers" => {
1208712120
"deps" => [
1208812121
"test/helpers/asynciotest-bin-ssltestlib.o",
12122+
"test/helpers/cert_comp_test-bin-ssltestlib.o",
1208912123
"test/helpers/cmp_asn_test-bin-cmp_testlib.o",
1209012124
"test/helpers/cmp_client_test-bin-cmp_testlib.o",
1209112125
"test/helpers/cmp_ctx_test-bin-cmp_testlib.o",
@@ -12147,6 +12181,7 @@ our %unified_info = (
1214712181
"products" => {
1214812182
"bin" => [
1214912183
"test/asynciotest",
12184+
"test/cert_comp_test",
1215012185
"test/cmp_asn_test",
1215112186
"test/cmp_client_test",
1215212187
"test/cmp_ctx_test",
@@ -21294,6 +21329,10 @@ our %unified_info = (
2129421329
"include",
2129521330
"apps/include"
2129621331
],
21332+
"test/bio_comp_test" => [
21333+
"include",
21334+
"apps/include"
21335+
],
2129721336
"test/bio_core_test" => [
2129821337
"include",
2129921338
"apps/include"
@@ -21879,6 +21918,10 @@ our %unified_info = (
2187921918
".",
2188021919
"include"
2188121920
],
21921+
"test/helpers/cert_comp_test-bin-ssltestlib.o" => [
21922+
".",
21923+
"include"
21924+
],
2188221925
"test/helpers/cmp_asn_test-bin-cmp_testlib.o" => [
2188321926
".",
2188421927
"include",
@@ -23607,6 +23650,7 @@ our %unified_info = (
2360723650
"test/bio_addr_test",
2360823651
"test/bio_base64_test",
2360923652
"test/bio_callback_test",
23653+
"test/bio_comp_test",
2361023654
"test/bio_core_test",
2361123655
"test/bio_dgram_test",
2361223656
"test/bio_enc_test",
@@ -23696,6 +23740,7 @@ our %unified_info = (
2369623740
"test/byteorder_test",
2369723741
"test/ca_internals_test",
2369823742
"test/casttest",
23743+
"test/cert_comp_test",
2369923744
"test/chacha_internal_test",
2370023745
"test/cipher_overhead_test",
2370123746
"test/cipherbytes_test",
@@ -24958,6 +25003,21 @@ our %unified_info = (
2495825003
"crypto/cms/libcrypto-lib-cms_smime.o" => [
2495925004
"crypto/cms/cms_smime.c"
2496025005
],
25006+
"crypto/comp/libcrypto-lib-c_brotli.o" => [
25007+
"crypto/comp/c_brotli.c"
25008+
],
25009+
"crypto/comp/libcrypto-lib-c_zlib.o" => [
25010+
"crypto/comp/c_zlib.c"
25011+
],
25012+
"crypto/comp/libcrypto-lib-c_zstd.o" => [
25013+
"crypto/comp/c_zstd.c"
25014+
],
25015+
"crypto/comp/libcrypto-lib-comp_err.o" => [
25016+
"crypto/comp/comp_err.c"
25017+
],
25018+
"crypto/comp/libcrypto-lib-comp_lib.o" => [
25019+
"crypto/comp/comp_lib.c"
25020+
],
2496125021
"crypto/conf/libcrypto-lib-conf_api.o" => [
2496225022
"crypto/conf/conf_api.c"
2496325023
],
@@ -27935,6 +27995,11 @@ our %unified_info = (
2793527995
"crypto/cms/libcrypto-lib-cms_rsa.o",
2793627996
"crypto/cms/libcrypto-lib-cms_sd.o",
2793727997
"crypto/cms/libcrypto-lib-cms_smime.o",
27998+
"crypto/comp/libcrypto-lib-c_brotli.o",
27999+
"crypto/comp/libcrypto-lib-c_zlib.o",
28000+
"crypto/comp/libcrypto-lib-c_zstd.o",
28001+
"crypto/comp/libcrypto-lib-comp_err.o",
28002+
"crypto/comp/libcrypto-lib-comp_lib.o",
2793828003
"crypto/conf/libcrypto-lib-conf_api.o",
2793928004
"crypto/conf/libcrypto-lib-conf_def.o",
2794028005
"crypto/conf/libcrypto-lib-conf_err.o",
@@ -30469,6 +30534,12 @@ our %unified_info = (
3046930534
"test/bio_callback_test-bin-bio_callback_test.o" => [
3047030535
"test/bio_callback_test.c"
3047130536
],
30537+
"test/bio_comp_test" => [
30538+
"test/bio_comp_test-bin-bio_comp_test.o"
30539+
],
30540+
"test/bio_comp_test-bin-bio_comp_test.o" => [
30541+
"test/bio_comp_test.c"
30542+
],
3047230543
"test/bio_core_test" => [
3047330544
"test/bio_core_test-bin-bio_core_test.o"
3047430545
],
@@ -31014,6 +31085,13 @@ our %unified_info = (
3101431085
"test/casttest-bin-casttest.o" => [
3101531086
"test/casttest.c"
3101631087
],
31088+
"test/cert_comp_test" => [
31089+
"test/cert_comp_test-bin-cert_comp_test.o",
31090+
"test/helpers/cert_comp_test-bin-ssltestlib.o"
31091+
],
31092+
"test/cert_comp_test-bin-cert_comp_test.o" => [
31093+
"test/cert_comp_test.c"
31094+
],
3101731095
"test/chacha_internal_test" => [
3101831096
"test/chacha_internal_test-bin-chacha_internal_test.o"
3101931097
],
@@ -31439,6 +31517,9 @@ our %unified_info = (
3143931517
"test/helpers/asynciotest-bin-ssltestlib.o" => [
3144031518
"test/helpers/ssltestlib.c"
3144131519
],
31520+
"test/helpers/cert_comp_test-bin-ssltestlib.o" => [
31521+
"test/helpers/ssltestlib.c"
31522+
],
3144231523
"test/helpers/cmp_asn_test-bin-cmp_testlib.o" => [
3144331524
"test/helpers/cmp_testlib.c"
3144431525
],
@@ -32662,18 +32743,9 @@ my %disabled_info = (
3266232743
"asan" => {
3266332744
"macro" => "OPENSSL_NO_ASAN"
3266432745
},
32665-
"brotli" => {
32666-
"macro" => "OPENSSL_NO_BROTLI"
32667-
},
3266832746
"brotli-dynamic" => {
3266932747
"macro" => "OPENSSL_NO_BROTLI_DYNAMIC"
3267032748
},
32671-
"comp" => {
32672-
"macro" => "OPENSSL_NO_COMP",
32673-
"skipped" => [
32674-
"crypto/comp"
32675-
]
32676-
},
3267732749
"crypto-mdebug" => {
3267832750
"macro" => "OPENSSL_NO_CRYPTO_MDEBUG"
3267932751
},
@@ -32767,15 +32839,9 @@ my %disabled_info = (
3276732839
"winstore" => {
3276832840
"macro" => "OPENSSL_NO_WINSTORE"
3276932841
},
32770-
"zlib" => {
32771-
"macro" => "OPENSSL_NO_ZLIB"
32772-
},
3277332842
"zlib-dynamic" => {
3277432843
"macro" => "OPENSSL_NO_ZLIB_DYNAMIC"
3277532844
},
32776-
"zstd" => {
32777-
"macro" => "OPENSSL_NO_ZSTD"
32778-
},
3277932845
"zstd-dynamic" => {
3278032846
"macro" => "OPENSSL_NO_ZSTD_DYNAMIC"
3278132847
}

‎deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*/
1212

1313
#define PLATFORM "platform: BSD-x86"
14-
#define DATE "built on: Tue Jan 27 17:25:31 2026 UTC"
14+
#define DATE "built on: Wed Mar 11 15:38:13 2026 UTC"
1515

1616
/*
1717
* Generate compiler_flags as an array of individual characters. This is a
@@ -29,5 +29,10 @@ static const char compiler_flags[] = {
2929
'_','S','A','F','E',' ','-','D','_','R','E','E','N','T','R','A',
3030
'N','T',' ','-','D','O','P','E','N','S','S','L','_','B','U','I',
3131
'L','D','I','N','G','_','O','P','E','N','S','S','L',' ','-','D',
32-
'N','D','E','B','U','G','\0'
32+
'B','R','O','T','L','I',' ','-','D','Z','L','I','B',' ','-','D',
33+
'Z','S','T','D',' ','-','D','N','D','E','B','U','G',' ','-','I',
34+
'.','.','/','.','.','/','b','r','o','t','l','i','/','c','/','i',
35+
'n','c','l','u','d','e',' ','-','I','.','.','/','.','.','/','z',
36+
'l','i','b',' ','-','I','.','.','/','.','.','/','z','s','t','d',
37+
'/','l','i','b','\0'
3338
};

‎deps/openssl/config/archs/BSD-x86/asm/include/openssl/configuration.h‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -41,15 +41,9 @@ extern "C" {
4141
# ifndef OPENSSL_NO_ASAN
4242
# define OPENSSL_NO_ASAN
4343
# endif
44-
# ifndef OPENSSL_NO_BROTLI
45-
# define OPENSSL_NO_BROTLI
46-
# endif
4744
# ifndef OPENSSL_NO_BROTLI_DYNAMIC
4845
# define OPENSSL_NO_BROTLI_DYNAMIC
4946
# endif
50-
# ifndef OPENSSL_NO_COMP
51-
# define OPENSSL_NO_COMP
52-
# endif
5347
# ifndef OPENSSL_NO_CRYPTO_MDEBUG
5448
# define OPENSSL_NO_CRYPTO_MDEBUG
5549
# endif
@@ -137,15 +131,9 @@ extern "C" {
137131
# ifndef OPENSSL_NO_WINSTORE
138132
# define OPENSSL_NO_WINSTORE
139133
# endif
140-
# ifndef OPENSSL_NO_ZLIB
141-
# define OPENSSL_NO_ZLIB
142-
# endif
143134
# ifndef OPENSSL_NO_ZLIB_DYNAMIC
144135
# define OPENSSL_NO_ZLIB_DYNAMIC
145136
# endif
146-
# ifndef OPENSSL_NO_ZSTD
147-
# define OPENSSL_NO_ZSTD
148-
# endif
149137
# ifndef OPENSSL_NO_ZSTD_DYNAMIC
150138
# define OPENSSL_NO_ZSTD_DYNAMIC
151139
# endif

0 commit comments

Comments
 (0)