src: add --openssl-legacy-provider option #40478

danbev · 2021-10-16T07:06:20Z

This commit adds an option to Node.js named --openssl-legacy-provider and
if specified will load OpenSSL 3.0 Legacy provider.

$ ./node --help
...
--openssl-legacy-provider  enable OpenSSL 3.0 legacy provider

Example usage:

$ ./node --openssl-legacy-provider  -p 'crypto.createHash("md4")'
Hash {
  _options: undefined,
  [Symbol(kHandle)]: Hash {},
  [Symbol(kState)]: { [Symbol(kFinalized)]: false }
}

Co-authored-by: Richard Lau rlau@redhat.com

Refs: #40455

This is an alternative to the suggestion in #40466

doc/api/cli.md

tniessen · 2021-10-16T11:51:17Z

Neither this PR nor #40466 load the legacy provider by default, and I think that makes sense. While these PRs make the legacy provider available, this will not unbreak npm.

test/parallel/test-process-env-allowed-flags-are-documented.js

richardlau · 2021-10-16T13:27:39Z

Neither this PR nor #40466 load the legacy provider by default, and I think that makes sense. While these PRs make the legacy provider available, this will not unbreak npm.

I agree about not being the default making sense -- this option should be intended to be used as a stop-gap until dependencies can be updated to migrate away from the weaker crypto algorithms.

nodejs-github-bot · 2021-10-16T14:44:23Z

CI: https://ci.nodejs.org/job/node-test-pull-request/40327/

nodejs-github-bot · 2021-10-16T15:50:31Z

CI: https://ci.nodejs.org/job/node-test-pull-request/40328/

doc/api/cli.md

This commit add the missing legacy provider source code which is requried for statically linking the OpenSSL legacy provider. Co-authored-by: Richard Lau <rlau@redhat.com>

Co-authored-by: Richard Lau <rlau@redhat.com>

This commit adds an option to Node.js named --openssl-legacy-provider and if specified will load OpenSSL 3.0 Legacy provider. $ ./node --help ... --openssl-legacy-provider enable OpenSSL 3.0 legacy provider Example usage: $ ./node --openssl-legacy-provider -p 'crypto.createHash("md4")' Hash { _options: undefined, [Symbol(kHandle)]: Hash {}, [Symbol(kState)]: { [Symbol(kFinalized)]: false } } Co-authored-by: Richard Lau <rlau@redhat.com> Refs: nodejs#40455

nodejs-github-bot · 2021-10-18T07:25:09Z

CI: https://ci.nodejs.org/job/node-test-pull-request/40341/

danbev · 2021-10-18T10:49:18Z

@tniessen @targos @RaisinTen @BethGriggs @mhdawson I would be great if we could get this PR merged today and into the Node.js 17 release tomorrow. Would one or more of you be able to review?

doc/api/cli.md

Update link and link text.

nodejs-github-bot · 2021-10-18T11:18:38Z

CI: https://ci.nodejs.org/job/node-test-pull-request/40343/

Notable Changes: Deprecations and Removals: - (SEMVER-MAJOR) dns: runtime deprecate type coercion of `dns.lookup` options (Antoine du Hamel) [#39793] - doc: deprecate (doc-only) http abort related (dr-js) [#36670] - (SEMVER-MAJOR) module: subpath folder mappings EOL (Guy Bedford) [#40121] - (SEMVER-MAJOR) module: runtime deprecate trailing slash patterns (Guy Bedford) [#40117] OpenSSL 3.0: Node.js now includes OpenSSL 3.0, specifically https://github.com/quictls/openssl which provides QUIC support. While OpenSSL 3.0 APIs should be mostly compatible with those provided by OpenSSL 1.1.1, we do anticipate some ecosystem impact due to tightened restrictions on the allowed algorithms and key sizes. If you hit an `ERR_OSSL_EVP_UNSUPPORTED` error in your application with Node.js 17, it’s likely that your application or a module you’re using is attempting to use an algorithm or key size which is no longer allowed by default with OpenSSL 3.0. A command-line option, `--openssl-legacy-provider`, has been added to revert to the legacy provider as a temporary workaround for these tightened restrictions. For details about all the features in OpenSSL 3.0 please see https://www.openssl.org/blog/blog/2021/09/07/OpenSSL3.Final. (Daniel Bevenius) [#38512] Contributed in #38512, #40478 V8 9.5: The V8 JavaScript engine is updated to V8 9.5. This release comes with additional supported types for the `Intl.DisplayNames` API and Extended `timeZoneName` options in the `Intl.DateTimeFormat` API. You can read more details in the V8 9.5 release post https://v8.dev/blog/v8-release-95. (Michaël Zasso) [#40178] Readline Promise API: The `readline` module provides an interface for reading data from a Readable stream (such as `process.stdin`) one line at a time. (Antoine du Hamel) [#37947] Other Notable Changes: - (SEMVER-MAJOR) dns: default to verbatim=true in dns.lookup() (treysis) [#39987] - (SEMVER-MAJOR) errors: print Node.js version on fatal exceptions that cause exit (Divlo) [#38332] - deps: upgrade npm to 8.1.0 (npm team) [#40463] - (SEMVER-MINOR) fs: add FileHandle.prototype.readableWebStream() (James M Snell) [#39331] - (SEMVER-MAJOR) lib: add structuredClone() global (Ethan Arrowood) [#39759] - (SEMVER-MAJOR) lib: expose `DOMException` as global (Khaidi Chu) [#39176] - (SEMVER-MAJOR) stream: finished should error on errored stream (Robert Nagy) [#39235] Semver-Major Commits: - (SEMVER-MAJOR) build: compile with C++17 (MSVC) (Richard Lau) [#38807] - (SEMVER-MAJOR) build: compile with --gnu++17 (Richard Lau) [#38807] - (SEMVER-MAJOR) deps: update V8 to 9.5.172.19 (Michaël Zasso) [#40178] - (SEMVER-MAJOR) deps,test,src,doc,tools: update to OpenSSL 3.0 (Daniel Bevenius) [#38512] - (SEMVER-MAJOR) dgram: tighten `address` validation in `socket.send` (Voltrex) [#39190] - (SEMVER-MAJOR) dns: runtime deprecate type coercion of `dns.lookup` options (Antoine du Hamel) [#39793] - (SEMVER-MAJOR) dns: default to verbatim=true in dns.lookup() (treysis) [#39987] - (SEMVER-MAJOR) doc: update minimum supported FreeBSD to 12.2 (Michaël Zasso) [#40179] - (SEMVER-MAJOR) errors: disp ver on fatal except that causes exit (Divlo) [#38332] - (SEMVER-MAJOR) fs: fix rmsync error swallowing (Nitzan Uziely) [#38684] - (SEMVER-MAJOR) fs: aggregate errors in fsPromises to avoid error swallowing (Nitzan Uziely) [#38259] - (SEMVER-MAJOR) lib: add structuredClone() global (Ethan Arrowood) [#39759] - (SEMVER-MAJOR) lib: expose `DOMException` as global (Khaidi Chu) [#39176] - (SEMVER-MAJOR) module: subpath folder mappings EOL (Guy Bedford) [#40121] - (SEMVER-MAJOR) module: runtime deprecate trailing slash patterns (Guy Bedford) [#40117] - (SEMVER-MAJOR) readline: validate `AbortSignal`s and remove unused event listeners (Antoine du Hamel) [#37947] - (SEMVER-MAJOR) readline: introduce promise-based API (Antoine du Hamel) [#37947] - (SEMVER-MAJOR) readline: refactor `Interface` to ES2015 class (Antoine du Hamel) [#37947] - (SEMVER-MAJOR) src: allow CAP\_NET\_BIND\_SERVICE in SafeGetenv (Daniel Bevenius) [#37727] - (SEMVER-MAJOR) src: return Maybe from a couple of functions (Darshan Sen) [#39603] - (SEMVER-MAJOR) src: allow custom PageAllocator in NodePlatform (Shelley Vohr) [#38362] - (SEMVER-MAJOR) stream: fix highwatermark threshold and add the missing error (Rongjian Zhang) [#38700] - (SEMVER-MAJOR) stream: don't emit 'data' after 'error' or 'close' (Robert Nagy) [#39639] - (SEMVER-MAJOR) stream: do not emit `end` on readable error (Szymon Marczak) [#39607] - (SEMVER-MAJOR) stream: forward errored to callback (Robert Nagy) [#39364] - (SEMVER-MAJOR) stream: destroy readable on read error (Robert Nagy) [#39342] - (SEMVER-MAJOR) stream: validate abort signal (Robert Nagy) [#39346] - (SEMVER-MAJOR) stream: unify stream utils (Robert Nagy) [#39294] - (SEMVER-MAJOR) stream: throw on premature close in Readable\ (Darshan Sen) [#39117] - (SEMVER-MAJOR) stream: finished should error on errored stream (Robert Nagy) [#39235] - (SEMVER-MAJOR) stream: error Duplex write/read if not writable/readable (Robert Nagy) [#34385] - (SEMVER-MAJOR) stream: bypass legacy destroy for pipeline and async iteration (Robert Nagy) [#38505] - (SEMVER-MAJOR) url: throw invalid this on detached accessors (James M Snell) [#39752] - (SEMVER-MAJOR) url: forbid certain confusable changes from being introduced by toASCII (Timothy Gu) [#38631] PR-URL: #40119

This adds a link to the --openssl-legacy-provider flag to the "Support for weak or compromised algorithms" section. PR-URL: #40593 Refs: #40478 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Voltrex <mohammadkeyvanzade94@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>

danielleadams · 2022-01-29T02:30:54Z

@danbev this has merge conflicts with v16.x-staging - would you be able to create a backport PR for this?

danielleadams · 2022-01-29T02:53:12Z

Actually - is this supposed to be pulled into v16 since this is for OpenSSL 3.0?

danbev · 2022-05-05T06:57:32Z

Actually - is this supposed to be pulled into v16 since this is for OpenSSL 3.0?

Sorry about the very late reply on this (at the time I was not working) .

Currently v16 is still on OpenSSL 1.1.1 so this would not be backported using the current commits. What I'm going to look at is if we can backport the option, --openssl-legacy-provider, so that it can be used when dynamically linking against OpenSSL 3.x.

This commit adds an option to Node.js named --openssl-legacy-provider and if specified will load OpenSSL 3.0 Legacy provider. $ ./node --help ... --openssl-legacy-provider enable OpenSSL 3.0 legacy provider Example usage: $ ./node --openssl-legacy-provider -p 'crypto.createHash("md4")' Hash { _options: undefined, [Symbol(kHandle)]: Hash {}, [Symbol(kState)]: { [Symbol(kFinalized)]: false } } Co-authored-by: Richard Lau <rlau@redhat.com> Refs: #40455 PR-URL: #40478 Backport-PR-URL: #42972 Refs: #40455 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>

This commit adds an option to Node.js named --openssl-legacy-provider and if specified will load OpenSSL 3.0 Legacy provider when dynamically linking Node.js v16.x with OpenSSL 3.0. Building: $ ./configure --shared-openssl \ --shared-openssl-libpath=/path/openssl_quic-3.0/lib64 \ --shared-openssl-includes=/path/openssl_quic-3.0/include \ --shared-openssl-libname=crypto,ssl $ make -j8 Verify options is available: $ ./node --help ... --openssl-legacy-provider enable OpenSSL 3.0 legacy provider Usage: $ export LD_LIBRARY_PATH=/path/openssl_quic-3.0/lib64 $ export OPENSSL_MODULES=/path/openssl_quic-3.0/lib64/ossl-modules/ $ export OPENSSL_CONF=/path/openssl_quic-3.0/ssl/openssl.cnf $ ./node --openssl-legacy-provider -p 'crypto.createHash("md4")' Hash { _options: undefined, [Symbol(kHandle)]: Hash {}, [Symbol(kState)]: { [Symbol(kFinalized)]: false } } Fixes: #40948 Refs: #40455 PR-URL: #40478 Backport-PR-URL: #42972 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Michael Dawson <midawson@redhat.com>

Notable changes OpenSSL: * add --openssl-legacy-provider option (Daniel Bevenius) #40478 deps: * V8: cherry-pick 3ebf2052a1b2 (Liu Yu) #43147 * upgrade npm to 8.11.0 (npm-cli+bot@github.com) #43210 Other notable changes: * tools: disable trap handler for Windows cross-compiler (Michaël Zasso) #40488 * tools: update V8 gypfiles for 9.6 (Michaël Zasso) #40488 PR-URL: TDB

Notable changes OpenSSL: * add --openssl-legacy-provider option (Daniel Bevenius) #40478 deps: * V8: cherry-pick 3ebf2052a1b2 (Liu Yu) #43147 * upgrade npm to 8.11.0 (npm-cli+bot@github.com) #43210 Other notable changes: * tools: disable trap handler for Windows cross-compiler (Michaël Zasso) #40488 * tools: update V8 gypfiles for 9.6 (Michaël Zasso) #40488 PR-URL: #43272

nodejs-github-bot added needs-ci openssl labels Oct 16, 2021

danbev mentioned this pull request Oct 16, 2021

Investigate loading legacy provider with OpenSSL 3.0 #40455

Closed

danbev mentioned this pull request Oct 16, 2021

deps,build: add OpenSSL building of legacy module #40466

Closed

tniessen reviewed Oct 16, 2021

View changes

doc/api/cli.md Outdated Show resolved Hide resolved

doc/api/cli.md Outdated Show resolved Hide resolved

richardlau reviewed Oct 16, 2021

View changes

test/parallel/test-process-env-allowed-flags-are-documented.js Outdated Show resolved Hide resolved

test/parallel/test-process-env-allowed-flags-are-documented.js Outdated Show resolved Hide resolved

richardlau added the request-ci label Oct 16, 2021

github-actions bot removed the request-ci label Oct 16, 2021

danbev changed the title ~~src: add --openssl-legacy-module option~~ src: add --openssl-legacy-provider option Oct 16, 2021

github-actions bot mentioned this pull request Oct 17, 2021

CI Reliability 2021-10-17 nodejs/reliability#89

Open

25 tasks

RaisinTen reviewed Oct 17, 2021

View changes

doc/api/cli.md Show resolved Hide resolved

github-actions bot mentioned this pull request Oct 18, 2021

CI Reliability 2021-10-18 nodejs/reliability#90

Open

27 tasks

danbev and others added 3 commits Oct 18, 2021

deps: add missing legacyprov.c source

1d10df9

This commit add the missing legacy provider source code which is requried for statically linking the OpenSSL legacy provider. Co-authored-by: Richard Lau <rlau@redhat.com>

deps: regenerate OpenSSL arch files

9bb7bd8

Co-authored-by: Richard Lau <rlau@redhat.com>

danbev force-pushed the openssl_legacy_static branch from 415743a to 86d1c0c Compare Oct 18, 2021

richardlau approved these changes Oct 18, 2021

View changes

doc/api/cli.md Outdated Show resolved Hide resolved

doc/api/cli.md Outdated Show resolved Hide resolved

tniessen approved these changes Oct 18, 2021

View changes

squash! src: add --openssl-legacy-provider option

780b643

Update link and link text.

danbev added the author ready label Oct 18, 2021

richardlau added the request-ci label Oct 18, 2021

tniessen approved these changes Oct 18, 2021

View changes

github-actions bot removed the request-ci label Oct 18, 2021

danbev closed this Oct 18, 2021

BethGriggs added the semver-minor label Oct 18, 2021

BethGriggs mentioned this pull request Oct 18, 2021

2021-10-19, Version 17.0.0 (Current) #40119

Merged

2 tasks

github-actions bot mentioned this pull request Oct 19, 2021

CI Reliability 2021-10-19 nodejs/reliability#91

Open

25 tasks

github-actions bot mentioned this pull request Oct 20, 2021

CI Reliability 2021-10-20 nodejs/reliability#92

Open

27 tasks

github-actions bot mentioned this pull request Oct 21, 2021

CI Reliability 2021-10-21 nodejs/reliability#93

Open

30 tasks

github-actions bot mentioned this pull request Oct 22, 2021

CI Reliability 2021-10-22 nodejs/reliability#94

Open

28 tasks

github-actions bot mentioned this pull request Oct 23, 2021

CI Reliability 2021-10-23 nodejs/reliability#95

Open

31 tasks

github-actions bot mentioned this pull request Oct 24, 2021

CI Reliability 2021-10-24 nodejs/reliability#96

Open

31 tasks

tniessen mentioned this pull request Oct 24, 2021

doc: ref OpenSSL legacy provider from crypto docs #40593

Closed

tniessen mentioned this pull request Jan 4, 2022

OSSL_EVP is not supported nodejs/help#3595

Open

danielleadams added backport-requested-v16.x and removed backport-requested-v16.x labels Jan 29, 2022

danbev mentioned this pull request May 5, 2022

[v16.x backport] src: add --openssl-legacy-provider option #42972

Open

juanarbol mentioned this pull request May 31, 2022

2022-05-XX, Version 16.16.0 'Gallium' (LTS) #43268

Closed

juanarbol mentioned this pull request Jun 1, 2022

v16.15.1 proposal #43272

Merged

nodejs / node Public

src: add --openssl-legacy-provider option #40478

src: add --openssl-legacy-provider option #40478

danbev commented Oct 16, 2021 •

edited

tniessen commented Oct 16, 2021

richardlau commented Oct 16, 2021

nodejs-github-bot commented Oct 16, 2021

nodejs-github-bot commented Oct 16, 2021

nodejs-github-bot commented Oct 18, 2021

danbev commented Oct 18, 2021

nodejs-github-bot commented Oct 18, 2021

danielleadams commented Jan 29, 2022

danielleadams commented Jan 29, 2022

danbev commented May 5, 2022

nodejs / node Public

src: add --openssl-legacy-provider option #40478

src: add --openssl-legacy-provider option #40478

Conversation

danbev commented Oct 16, 2021 • edited

tniessen commented Oct 16, 2021

richardlau commented Oct 16, 2021

nodejs-github-bot commented Oct 16, 2021

nodejs-github-bot commented Oct 16, 2021

nodejs-github-bot commented Oct 18, 2021

danbev commented Oct 18, 2021

nodejs-github-bot commented Oct 18, 2021

danielleadams commented Jan 29, 2022

danielleadams commented Jan 29, 2022

danbev commented May 5, 2022

danbev commented Oct 16, 2021 •

edited