Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 933d9ca

Browse files
danbevjuanarbol
authored andcommittedJun 1, 2022
src: add --openssl-legacy-provider option
This commit adds an option to Node.js named --openssl-legacy-provider and if specified will load OpenSSL 3.0 Legacy provider when dynamically linking Node.js v16.x with OpenSSL 3.0. Building: $ ./configure --shared-openssl \ --shared-openssl-libpath=/path/openssl_quic-3.0/lib64 \ --shared-openssl-includes=/path/openssl_quic-3.0/include \ --shared-openssl-libname=crypto,ssl $ make -j8 Verify options is available: $ ./node --help ... --openssl-legacy-provider enable OpenSSL 3.0 legacy provider Usage: $ export LD_LIBRARY_PATH=/path/openssl_quic-3.0/lib64 $ export OPENSSL_MODULES=/path/openssl_quic-3.0/lib64/ossl-modules/ $ export OPENSSL_CONF=/path/openssl_quic-3.0/ssl/openssl.cnf $ ./node --openssl-legacy-provider -p 'crypto.createHash("md4")' Hash { _options: undefined, [Symbol(kHandle)]: Hash {}, [Symbol(kState)]: { [Symbol(kFinalized)]: false } } Fixes: #40948 Refs: #40455 PR-URL: #40478 Backport-PR-URL: #42972 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Michael Dawson <[email protected]>
1 parent f7c4ce2 commit 933d9ca

File tree

5 files changed

+36
-0
lines changed

5 files changed

+36
-0
lines changed
 

‎doc/api/cli.md

+11
Original file line numberDiff line numberDiff line change
@@ -732,6 +732,15 @@ Load an OpenSSL configuration file on startup. Among other uses, this can be
732732
used to enable FIPS-compliant crypto if Node.js is built
733733
against FIPS-enabled OpenSSL.
734734

735+
### `--openssl-legacy-provider`
736+
737+
<!-- YAML
738+
added: REPLACEME
739+
-->
740+
741+
Enable OpenSSL 3.0 legacy provider when dynamically linking to OpenSSL 3.x.
742+
For more information please see [OSSL\_PROVIDER-legacy][OSSL_PROVIDER-legacy].
743+
735744
### `--pending-deprecation`
736745

737746
<!-- YAML
@@ -1592,6 +1601,7 @@ Node.js options that are allowed are:
15921601
* `--no-warnings`
15931602
* `--node-memory-debug`
15941603
* `--openssl-config`
1604+
* `--openssl-legacy-provider`
15951605
* `--pending-deprecation`
15961606
* `--policy-integrity`
15971607
* `--preserve-symlinks-main`
@@ -1952,6 +1962,7 @@ $ node --max-old-space-size=1536 index.js
19521962
[ECMAScript module loader]: esm.md#loaders
19531963
[Fetch API]: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API
19541964
[Modules loaders]: packages.md#modules-loaders
1965+
[OSSL_PROVIDER-legacy]: https://www.openssl.org/docs/man3.0/man7/OSSL_PROVIDER-legacy.html
19551966
[REPL]: repl.md
19561967
[ScriptCoverage]: https://chromedevtools.github.io/devtools-protocol/tot/Profiler#type-ScriptCoverage
19571968
[Source Map]: https://sourcemaps.info/spec.html

‎src/crypto/crypto_util.cc

+10
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,16 @@ void InitCryptoOnce() {
148148
}
149149
#endif
150150

151+
#if OPENSSL_VERSION_MAJOR >= 3
152+
// --openssl-legacy-provider
153+
if (per_process::cli_options->openssl_legacy_provider) {
154+
OSSL_PROVIDER* legacy_provider = OSSL_PROVIDER_load(nullptr, "legacy");
155+
if (legacy_provider == nullptr) {
156+
fprintf(stderr, "Unable to load legacy provider.\n");
157+
}
158+
}
159+
#endif
160+
151161
OPENSSL_init_ssl(0, settings);
152162
OPENSSL_INIT_free(settings);
153163
settings = nullptr;

‎src/node_options.cc

+3
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@
55
#include "node_binding.h"
66
#include "node_external_reference.h"
77
#include "node_internals.h"
8+
#if HAVE_OPENSSL
9+
#include "openssl/opensslv.h"
10+
#endif
811

912
#include <errno.h>
1013
#include <sstream>

‎src/node_options.h

+7
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@
1111
#include "node_mutex.h"
1212
#include "util.h"
1313

14+
#if HAVE_OPENSSL
15+
#include "openssl/opensslv.h"
16+
#endif
17+
1418
namespace node {
1519

1620
class HostPort {
@@ -252,6 +256,9 @@ class PerProcessOptions : public Options {
252256
bool enable_fips_crypto = false;
253257
bool force_fips_crypto = false;
254258
#endif
259+
#if OPENSSL_VERSION_MAJOR >= 3
260+
bool openssl_legacy_provider = false;
261+
#endif
255262

256263
// Per-process because reports can be triggered outside a known V8 context.
257264
bool report_on_fatalerror = false;

‎test/parallel/test-process-env-allowed-flags-are-documented.js

+5
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,18 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
4343
}
4444
}
4545

46+
if (!common.hasOpenSSL3) {
47+
documented.delete('--openssl-legacy-provider');
48+
}
49+
4650
// Filter out options that are conditionally present.
4751
const conditionalOpts = [
4852
{
4953
include: common.hasCrypto,
5054
filter: (opt) => {
5155
return [
5256
'--openssl-config',
57+
common.hasOpenSSL3 ? '--openssl-legacy-provider' : '',
5358
'--tls-cipher-list',
5459
'--use-bundled-ca',
5560
'--use-openssl-ca',

0 commit comments

Comments
 (0)
Please sign in to comment.