src: add --openssl-legacy-provider option

danbev · danbev · commit 1d2f37d970e8 · 2021-10-18T15:43:16.000+02:00
This commit adds an option to Node.js named --openssl-legacy-provider and if specified will load OpenSSL 3.0 Legacy provider. $ ./node --help ... --openssl-legacy-provider enable OpenSSL 3.0 legacy provider Example usage: $ ./node --openssl-legacy-provider -p 'crypto.createHash("md4")' Hash { _options: undefined, [Symbol(kHandle)]: Hash {}, [Symbol(kState)]: { [Symbol(kFinalized)]: false } } Co-authored-by: Richard Lau <rlau@redhat.com> Refs: #40455 PR-URL: #40478 Refs: #40455 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
diff --git a/doc/api/cli.md b/doc/api/cli.md
@@ -670,6 +670,14 @@ Load an OpenSSL configuration file on startup. Among other uses, this can be
 used to enable FIPS-compliant crypto if Node.js is built
 against FIPS-enabled OpenSSL.
 
+### `--openssl-legacy-provider`
+<!-- YAML
+added: REPLACEME
+-->
+
+Enable OpenSSL 3.0 legacy provider. For more information please see
+[OSSL_PROVIDER-legacy][].
+
 ### `--pending-deprecation`
 <!-- YAML
 added: v8.0.0
@@ -1463,6 +1471,7 @@ Node.js options that are allowed are:
 * `--no-warnings`
 * `--node-memory-debug`
 * `--openssl-config`
+* `--openssl-legacy-provider`
 * `--pending-deprecation`
 * `--policy-integrity`
 * `--preserve-symlinks-main`
@@ -1805,6 +1814,7 @@ $ node --max-old-space-size=1536 index.js
 
 [Chrome DevTools Protocol]: https://chromedevtools.github.io/devtools-protocol/
 [ECMAScript Module loader]: esm.md#loaders
+[OSSL_PROVIDER-legacy]: https://www.openssl.org/docs/man3.0/man7/OSSL_PROVIDER-legacy.html
 [REPL]: repl.md
 [ScriptCoverage]: https://chromedevtools.github.io/devtools-protocol/tot/Profiler#type-ScriptCoverage
 [Source Map]: https://sourcemaps.info/spec.html
diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
@@ -136,6 +136,16 @@ void InitCryptoOnce() {
   }
 #endif
 
+#if OPENSSL_VERSION_MAJOR >= 3
+  // --openssl-legacy-provider
+  if (per_process::cli_options->openssl_legacy_provider) {
+    OSSL_PROVIDER* legacy_provider = OSSL_PROVIDER_load(nullptr, "legacy");
+    if (legacy_provider == nullptr) {
+      fprintf(stderr, "Unable to load legacy provider.\n");
+    }
+  }
+#endif
+
   OPENSSL_init_ssl(0, settings);
   OPENSSL_INIT_free(settings);
   settings = nullptr;
diff --git a/src/node_options.cc b/src/node_options.cc
@@ -4,6 +4,9 @@
 #include "env-inl.h"
 #include "node_binding.h"
 #include "node_internals.h"
+#if HAVE_OPENSSL
+#include "openssl/opensslv.h"
+#endif
 
 #include <errno.h>
 #include <sstream>
@@ -814,6 +817,13 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             &PerProcessOptions::secure_heap_min,
             kAllowedInEnvironment);
 #endif
+#if OPENSSL_VERSION_MAJOR >= 3
+  AddOption("--openssl-legacy-provider",
+            "enable OpenSSL 3.0 legacy provider",
+            &PerProcessOptions::openssl_legacy_provider,
+            kAllowedInEnvironment);
+
+#endif  // OPENSSL_VERSION_MAJOR
   AddOption("--use-largepages",
             "Map the Node.js static code to large pages. Options are "
             "'off' (the default value, meaning do not map), "
diff --git a/src/node_options.h b/src/node_options.h
@@ -11,6 +11,10 @@
 #include "node_mutex.h"
 #include "util.h"
 
+#if HAVE_OPENSSL
+#include "openssl/opensslv.h"
+#endif
+
 namespace node {
 
 class HostPort {
@@ -252,6 +256,9 @@ class PerProcessOptions : public Options {
   bool enable_fips_crypto = false;
   bool force_fips_crypto = false;
 #endif
+#if OPENSSL_VERSION_MAJOR >= 3
+  bool openssl_legacy_provider = false;
+#endif
 
   // Per-process because reports can be triggered outside a known V8 context.
   bool report_on_fatalerror = false;
diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
@@ -40,13 +40,18 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
   }
 }
 
+if (!common.hasOpenSSL3) {
+  documented.delete('--openssl-legacy-provider');
+}
+
 // Filter out options that are conditionally present.
 const conditionalOpts = [
   {
     include: common.hasCrypto,
     filter: (opt) => {
       return [
         '--openssl-config',
+        common.hasOpenSSL3 ? '--openssl-legacy-provider' : '',
         '--tls-cipher-list',
         '--use-bundled-ca',
         '--use-openssl-ca',

Original file line number	Diff line number	Diff line change
`@@ -40,13 +40,18 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {`
`40`	`40`	`}`
`41`	`41`	`}`
`42`	`42`
	`43`	`+if (!common.hasOpenSSL3) {`
	`44`	`+ documented.delete('--openssl-legacy-provider');`
	`45`	`+}`
	`46`	`+`
`43`	`47`	`// Filter out options that are conditionally present.`
`44`	`48`	`const conditionalOpts = [`
`45`	`49`	`{`
`46`	`50`	`include: common.hasCrypto,`
`47`	`51`	`filter: (opt) => {`
`48`	`52`	`return [`
`49`	`53`	`'--openssl-config',`
	`54`	`+ common.hasOpenSSL3 ? '--openssl-legacy-provider' : '',`
`50`	`55`	`'--tls-cipher-list',`
`51`	`56`	`'--use-bundled-ca',`
`52`	`57`	`'--use-openssl-ca',`