Forcibly clear OpenSSL's error stack

* Add a test for the bug of unwanted openSSL errors
* bad_sign() would inject an error into OpenSSL's error stack
* Second time of calling requestThunk would make the error be thrown
* This stops stale errors from popping up later causing spurious failures
* FIXME: remove me when upstream Node.js has fixed this bug

Author: pmq20

lib/urllib.js

@@ -62,6 +62,18 @@ var TEXT_DATA_TYPES = [
   'text'
 ];
 
+// OpenSSL's error stack might already have some content stored
+// Forcibly clear OpenSSL's error stack before reusing an old connection.
+// This stops stale errors from popping up later causing spurious failures.
+// FIXME: remove me when upstream Node.js has fixed this bug
+var binding = process.binding('crypto');
+var NativeSecureContext = binding.SecureContext;
+var workaround_clear_openssl_errors = function() {
+  var context = new NativeSecureContext();
+  context.init();
+  context.addRootCerts();
+};
+
 /**
  * Handle all http request, both http and https support well.
  *
@@ -188,6 +200,7 @@ exports.requestWithCallback = function (url, args, callback) {
   var agent = args.agent || exports.agent;
 
   if (parsedUrl.protocol === 'https:') {
+    workaround_clear_openssl_errors();
     httplib = https;
     agent = args.httpsAgent || exports.httpsAgent;
     if (args.httpsAgent === false) {

test/fixtures/bad_rsa_privkey.pem

@@ -0,0 +1,10 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIBUwIBADANBgkqhkiG9w0BAQEFAASCAT0wggE5AgEAAkEAz0ZHmXyxQSdWk6NF
+GRotTax0O94iHv843su0mOynV9QLvlAwMrUk9k4+/SwyLu0eE3iYsYgXstXi3t2u
+rDSIMwIDAQABAkAH4ag/Udp7m79TBdZOygwG9BPHYv7xJstGzYAkgHssf7Yd5ZuC
+hpKtBvWdPXZaAFbwF8NSisMl98Q/9zgB/q5BAiEA5zXuwMnwt4hE2YqzBDRFB4g9
+I+v+l1soy6x7Wdqo9esCIQDlf15qDb26uRDurBioE3IpZstWIIvLDdKqviZXKMs8
+2QIgWeC5QvA9RtsOCJLGLCg1fUwUmFYwzZ1+Kk6OVMuPSqkCIDIWFSXyL8kzoKVm
+O89axxyQCaqXWcsMDkEjVLzK82gpAiB7lzdDHr7MoMWwV2wC/heEFC2p0Rw4wg9j
+1V8QbL0Q0A==
+-----END RSA PRIVATE KEY-----

test/openssl.test.js

@@ -0,0 +1,75 @@
+/**!
+ * urllib - openssl.test.js
+ *
+ * Copyright(c) node-modules and other contributors.
+ * MIT Licensed
+ *
+ * Authors:
+ *   P.S.V.R <pmq2001@gmail.com> (http://www.ofpsvr.com)
+ */
+
+'use strict';
+
+/**
+ * This is a test for the bug of unwanted openSSL errors.
+ */
+
+var should = require('should');
+var urllib = require('../');
+var crypto = require('crypto');
+var fs = require('fs');
+var path = require('path');
+var Agent = require('agentkeepalive');
+var HttpsAgent = require('agentkeepalive').HttpsAgent;
+
+var bad_sign = function () {
+  // This triggers an implicit error
+  // that is recorded onto OpenSSL's error stack
+  var privateKey = fs.readFileSync(path.join(__dirname, './fixtures/bad_rsa_privkey.pem'), 'utf8');
+  var s = crypto.createSign('sha1');
+  var sign = s.sign(privateKey);
+};
+
+describe('httpclient.test.js', function () {
+  it('should requestThunk()', function (done) {
+    var conf = {
+      "keepAlive": true,
+      "keepAliveTimeout": 300000,
+      "timeout": 300000,
+      "maxSockets": null,
+      "maxFreeSockets": 10,
+      "enableStatusLog": false
+    };
+
+    var httpAgent = new Agent(conf);
+    var httpsAgent = new HttpsAgent(conf);
+
+    var client = urllib.create({
+      agent: httpAgent,
+      httpsAgent: httpsAgent
+    });
+
+    bad_sign();
+    // 1st time when we establish a https connection,
+    // ~ClearErrorOnReturn is called so the errors of bad_sign() won't be thrown
+    client.requestThunk('https://iojs.org')(function (err, result) {
+      should.not.exist(err);
+      result.data.should.be.a.Buffer;
+      result.status.should.equal(200);
+
+      setImmediate(function () {
+        // 2nd time when we reuse an existing connection,
+        // ~ClearErrorOnReturn will not be called,
+        // making the errors of bad_sign() be thrown
+        // A fix of this bug should prevent this from happening
+        bad_sign();
+        client.requestThunk('https://iojs.org')(function (err, result) {
+          should.not.exist(err);
+          result.data.should.be.a.Buffer;
+          result.status.should.equal(200);
+          done();
+        });
+      });
+    });
+  });
+});