{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/18770","repository_url":"https://api.github.com/repos/nodejs/node","labels_url":"https://api.github.com/repos/nodejs/node/issues/18770/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/18770/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/18770/events","html_url":"https://github.com/nodejs/node/issues/18770","id":296925148,"node_id":"MDU6SXNzdWUyOTY5MjUxNDg=","number":18770,"title":"OpenSSL 1.1.1 Support TODO (pls help)","user":{"login":"rvagg","id":495647,"node_id":"MDQ6VXNlcjQ5NTY0Nw==","avatar_url":"https://avatars2.githubusercontent.com/u/495647?v=4","gravatar_id":"","url":"https://api.github.com/users/rvagg","html_url":"https://github.com/rvagg","followers_url":"https://api.github.com/users/rvagg/followers","following_url":"https://api.github.com/users/rvagg/following{/other_user}","gists_url":"https://api.github.com/users/rvagg/gists{/gist_id}","starred_url":"https://api.github.com/users/rvagg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rvagg/subscriptions","organizations_url":"https://api.github.com/users/rvagg/orgs","repos_url":"https://api.github.com/users/rvagg/repos","events_url":"https://api.github.com/users/rvagg/events{/privacy}","received_events_url":"https://api.github.com/users/rvagg/received_events","type":"User","site_admin":false},"labels":[{"id":151728677,"node_id":"MDU6TGFiZWwxNTE3Mjg2Nzc=","url":"https://api.github.com/repos/nodejs/node/labels/help%20wanted","name":"help wanted","color":"159818","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":14,"created_at":"2018-02-13T23:36:19Z","updated_at":"2018-10-31T00:55:06Z","closed_at":null,"author_association":"MEMBER","body":"@nodejs/crypto\r\n\r\nOpenSSL 1.1.1-pre1 was [released today](https://www.openssl.org/news/openssl-1.1.1-notes.html). The headline item is TLS 1.3 (worth noting that the spec hasn't quite been finalised yet). This is obviously only a pre-release, not final and not supposed to be entirely bug free.\r\n\r\nThe OpenSSL team have said previously that 1.1.1 would be API and ABI compatible with 1.1.0. We currently have 1.1.0 support in Node so the theory goes that it shouldn't be too difficult an upgrade path. This is nice because it's _possible_ (but not yet known) that 1.1.1 is the next LTS of OpenSSL, with 1.1.0 going EOL soon. 1.1.0 -> 1.1.1 or just straight to 1.1.1 might have to be our Node 10 strategy (I'm outlining that case [here](https://github.com/nodejs/TSC/pull/479)).\r\n\r\n_So_, getting as close to 1.1.1 support as possible even while it's pre-release would be very valuable for us. Maintaining 1.0.2 and 1.1.0 support in the meantime is preferable (perhaps essential thanks to distribution dependencies). There will be a time, after 1.0.2 EOL next year, that we can ditch all the cruft but for now if we can do all 3 then that's what we should do.\r\n\r\nOur CI tests 1.0.2 (obviously) and 1.0.2 dynamically linked. It also tests dynamic linking to 1.1.0 in Node 9+ (soon 8 too I think). See https://ci.nodejs.org/job/node-test-commit-linux-containered/ for this happening.\r\n\r\nI've also 1.1.1-pre1 to the same containers that are used to run these other dynamic-linked tests and I can turn that on as needed. For now it's too broken to turn on full-time, so this is the call to help fix that!\r\n\r\nNode compiles just fine with 1.1.1-pre1 thanks to @davidben's most excellent work in #16130. But it currently fails 55 tests in CI (there may be at least one async-wrap flaky in there).\r\n\r\n**We need help figuring out whether these are things that we can fix on our end or whether they are upstream problems**. If OpenSSL 1.1.1 isn't properly API compatible with 1.1.0 then I'd like us to push back on them to get them to stick to that commitment.\r\n\r\n```\r\nnot ok 36 parallel/test-async-wrap-GH13045\r\nnot ok 953 parallel/test-https-agent-create-connection\r\nnot ok 957 parallel/test-https-agent-session-reuse\r\nnot ok 964 parallel/test-https-client-resume\r\nnot ok 969 parallel/test-https-agent-additional-options\r\nnot ok 1130 parallel/test-http2-https-fallback\r\nnot ok 1230 parallel/test-https-drain\r\nnot ok 1234 parallel/test-https-eof-for-eom\r\nnot ok 1519 parallel/test-tls-alpn-server-client\r\nnot ok 1533 parallel/test-tls-client-getephemeralkeyinfo\r\nnot ok 1534 parallel/test-tls-client-mindhsize\r\nnot ok 1535 parallel/test-tls-client-reject\r\nnot ok 1536 parallel/test-tls-addca\r\nnot ok 1537 parallel/test-tls-alert-handling\r\nnot ok 1539 parallel/test-tls-async-cb-after-socket-end\r\nnot ok 1542 parallel/test-tls-close-notify\r\nnot ok 1549 parallel/test-tls-connect-stream-writes\r\nnot ok 1553 parallel/test-tls-client-resume\r\nnot ok 1554 parallel/test-tls-disable-renegotiation\r\nnot ok 1555 parallel/test-tls-ecdh\r\nnot ok 1556 parallel/test-tls-ecdh-auto\r\nnot ok 1558 parallel/test-tls-ecdh-multiple\r\nnot ok 1562 parallel/test-tls-env-extra-ca\r\nnot ok 1566 parallel/test-tls-client-verify\r\nnot ok 1568 parallel/test-tls-getcipher\r\nnot ok 1569 parallel/test-tls-connect-given-socket\r\nnot ok 1576 parallel/test-tls-dhe\r\nnot ok 1577 parallel/test-tls-friendly-error-message\r\nnot ok 1583 parallel/test-tls-multi-key\r\nnot ok 1584 parallel/test-tls-multi-pfx\r\nnot ok 1585 parallel/test-tls-interleave\r\nnot ok 1586 parallel/test-tls-invoke-queued\r\nnot ok 1590 parallel/test-tls-npn-server-client\r\nnot ok 1591 parallel/test-tls-ocsp-callback\r\nnot ok 1592 parallel/test-tls-js-stream\r\nnot ok 1599 parallel/test-tls-peer-certificate-encoding\r\nnot ok 1600 parallel/test-tls-peer-certificate-multi-keys\r\nnot ok 1602 parallel/test-tls-net-connect-prefer-path\r\nnot ok 1607 parallel/test-tls-securepair-server\r\nnot ok 1608 parallel/test-tls-no-rsa-key\r\nnot ok 1611 parallel/test-tls-server-verify\r\nnot ok 1612 parallel/test-tls-on-empty-socket\r\nnot ok 1614 parallel/test-tls-set-ciphers\r\nnot ok 1615 parallel/test-tls-sni-option\r\nnot ok 1616 parallel/test-tls-sni-server-client\r\nnot ok 1618 parallel/test-tls-socket-constructor-alpn-npn-options-parsing\r\nnot ok 1619 parallel/test-tls-regr-gh-5108\r\nnot ok 1625 parallel/test-tls-ticket\r\nnot ok 1626 parallel/test-tls-ticket-cluster\r\nnot ok 1648 parallel/test-tls-server-connection-server\r\nnot ok 1871 async-hooks/test-tlswrap\r\nnot ok 1878 async-hooks/test-writewrap\r\nnot ok 1945 parallel/test-tls-set-encoding\r\nnot ok 1952 parallel/test-tls-socket-default-options\r\nnot ok 2012 sequential/test-benchmark-tls\r\n```\r\n\r\nFull output is captured here https://gist.github.com/rvagg/cdead09ffa269453d728dcf9bc831d3d (it comes from [here](https://ci.nodejs.org/job/node-test-commit-linux-containered/2224/nodes=ubuntu1604_sharedlibs_openssl111_x64/) but that link is not going to survive)."},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/434523194","html_url":"https://github.com/nodejs/node/issues/18770#issuecomment-434523194","issue_url":"https://api.github.com/repos/nodejs/node/issues/18770","id":434523194,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNDUyMzE5NA==","user":{"login":"rvagg","id":495647,"node_id":"MDQ6VXNlcjQ5NTY0Nw==","avatar_url":"https://avatars2.githubusercontent.com/u/495647?v=4","gravatar_id":"","url":"https://api.github.com/users/rvagg","html_url":"https://github.com/rvagg","followers_url":"https://api.github.com/users/rvagg/followers","following_url":"https://api.github.com/users/rvagg/following{/other_user}","gists_url":"https://api.github.com/users/rvagg/gists{/gist_id}","starred_url":"https://api.github.com/users/rvagg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rvagg/subscriptions","organizations_url":"https://api.github.com/users/rvagg/orgs","repos_url":"https://api.github.com/users/rvagg/repos","events_url":"https://api.github.com/users/rvagg/events{/privacy}","received_events_url":"https://api.github.com/users/rvagg/received_events","type":"User","site_admin":false},"created_at":"2018-10-31T00:55:06Z","updated_at":"2018-10-31T00:55:06Z","author_association":"MEMBER","body":"Very nice @sam-github, I'll take a look as soon as I can. A bit busy this week but this is exciting stuff!\r\nHow did you go with solving the test-tls-server-verify / `SSL_CB_HANDSHAKE_START/DONE` thing? I was under the impression that this was a fairly fundamental problem."}}
{"actor":{"display_login":"rvagg"}}