Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 1d2f37d

Browse filesBrowse files
danbevdanbev
committed
src: add --openssl-legacy-provider option
This commit adds an option to Node.js named --openssl-legacy-provider and if specified will load OpenSSL 3.0 Legacy provider. $ ./node --help ... --openssl-legacy-provider enable OpenSSL 3.0 legacy provider Example usage: $ ./node --openssl-legacy-provider -p 'crypto.createHash("md4")' Hash { _options: undefined, [Symbol(kHandle)]: Hash {}, [Symbol(kState)]: { [Symbol(kFinalized)]: false } } Co-authored-by: Richard Lau <rlau@redhat.com> Refs: #40455 PR-URL: #40478 Refs: #40455 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
1 parent d434c53 commit 1d2f37d
Copy full SHA for 1d2f37d

File tree

Expand file treeCollapse file tree

5 files changed

+42
-0
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

5 files changed

+42
-0
lines changed
Open diff view settings
Collapse file

‎doc/api/cli.md‎

Copy file name to clipboardExpand all lines: doc/api/cli.md
+10Lines changed: 10 additions & 0 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -670,6 +670,14 @@ Load an OpenSSL configuration file on startup. Among other uses, this can be
670670
used to enable FIPS-compliant crypto if Node.js is built
671671
against FIPS-enabled OpenSSL.
672672

673+
### `--openssl-legacy-provider`
674+
<!-- YAML
675+
added: REPLACEME
676+
-->
677+
678+
Enable OpenSSL 3.0 legacy provider. For more information please see
679+
[OSSL_PROVIDER-legacy][].
680+
673681
### `--pending-deprecation`
674682
<!-- YAML
675683
added: v8.0.0
@@ -1463,6 +1471,7 @@ Node.js options that are allowed are:
14631471
* `--no-warnings`
14641472
* `--node-memory-debug`
14651473
* `--openssl-config`
1474+
* `--openssl-legacy-provider`
14661475
* `--pending-deprecation`
14671476
* `--policy-integrity`
14681477
* `--preserve-symlinks-main`
@@ -1805,6 +1814,7 @@ $ node --max-old-space-size=1536 index.js
18051814

18061815
[Chrome DevTools Protocol]: https://chromedevtools.github.io/devtools-protocol/
18071816
[ECMAScript Module loader]: esm.md#loaders
1817+
[OSSL_PROVIDER-legacy]: https://www.openssl.org/docs/man3.0/man7/OSSL_PROVIDER-legacy.html
18081818
[REPL]: repl.md
18091819
[ScriptCoverage]: https://chromedevtools.github.io/devtools-protocol/tot/Profiler#type-ScriptCoverage
18101820
[Source Map]: https://sourcemaps.info/spec.html
Collapse file

‎src/crypto/crypto_util.cc‎

Copy file name to clipboardExpand all lines: src/crypto/crypto_util.cc
+10Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,16 @@ void InitCryptoOnce() {
136136
}
137137
#endif
138138

139+
#if OPENSSL_VERSION_MAJOR >= 3
140+
// --openssl-legacy-provider
141+
if (per_process::cli_options->openssl_legacy_provider) {
142+
OSSL_PROVIDER* legacy_provider = OSSL_PROVIDER_load(nullptr, "legacy");
143+
if (legacy_provider == nullptr) {
144+
fprintf(stderr, "Unable to load legacy provider.\n");
145+
}
146+
}
147+
#endif
148+
139149
OPENSSL_init_ssl(0, settings);
140150
OPENSSL_INIT_free(settings);
141151
settings = nullptr;
Collapse file

‎src/node_options.cc‎

Copy file name to clipboardExpand all lines: src/node_options.cc
+10Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@
44
#include "env-inl.h"
55
#include "node_binding.h"
66
#include "node_internals.h"
7+
#if HAVE_OPENSSL
8+
#include "openssl/opensslv.h"
9+
#endif
710

811
#include <errno.h>
912
#include <sstream>
@@ -814,6 +817,13 @@ PerProcessOptionsParser::PerProcessOptionsParser(
814817
&PerProcessOptions::secure_heap_min,
815818
kAllowedInEnvironment);
816819
#endif
820+
#if OPENSSL_VERSION_MAJOR >= 3
821+
AddOption("--openssl-legacy-provider",
822+
"enable OpenSSL 3.0 legacy provider",
823+
&PerProcessOptions::openssl_legacy_provider,
824+
kAllowedInEnvironment);
825+
826+
#endif // OPENSSL_VERSION_MAJOR
817827
AddOption("--use-largepages",
818828
"Map the Node.js static code to large pages. Options are "
819829
"'off' (the default value, meaning do not map), "
Collapse file

‎src/node_options.h‎

Copy file name to clipboardExpand all lines: src/node_options.h
+7Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@
1111
#include "node_mutex.h"
1212
#include "util.h"
1313

14+
#if HAVE_OPENSSL
15+
#include "openssl/opensslv.h"
16+
#endif
17+
1418
namespace node {
1519

1620
class HostPort {
@@ -252,6 +256,9 @@ class PerProcessOptions : public Options {
252256
bool enable_fips_crypto = false;
253257
bool force_fips_crypto = false;
254258
#endif
259+
#if OPENSSL_VERSION_MAJOR >= 3
260+
bool openssl_legacy_provider = false;
261+
#endif
255262

256263
// Per-process because reports can be triggered outside a known V8 context.
257264
bool report_on_fatalerror = false;
Collapse file

‎test/parallel/test-process-env-allowed-flags-are-documented.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-process-env-allowed-flags-are-documented.js
+5Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,13 +40,18 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
4040
}
4141
}
4242

43+
if (!common.hasOpenSSL3) {
44+
documented.delete('--openssl-legacy-provider');
45+
}
46+
4347
// Filter out options that are conditionally present.
4448
const conditionalOpts = [
4549
{
4650
include: common.hasCrypto,
4751
filter: (opt) => {
4852
return [
4953
'--openssl-config',
54+
common.hasOpenSSL3 ? '--openssl-legacy-provider' : '',
5055
'--tls-cipher-list',
5156
'--use-bundled-ca',
5257
'--use-openssl-ca',

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.