Skip to content

Commit 55bbdd7

Browse files
danbevjuanarbol
authored andcommitted
src: add --openssl-legacy-provider option
This commit adds an option to Node.js named --openssl-legacy-provider and if specified will load OpenSSL 3.0 Legacy provider. $ ./node --help ... --openssl-legacy-provider enable OpenSSL 3.0 legacy provider Example usage: $ ./node --openssl-legacy-provider -p 'crypto.createHash("md4")' Hash { _options: undefined, [Symbol(kHandle)]: Hash {}, [Symbol(kState)]: { [Symbol(kFinalized)]: false } } Co-authored-by: Richard Lau <[email protected]> Refs: #40455 PR-URL: #40478 Backport-PR-URL: #42972 Refs: #40455 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Tobias Nießen <[email protected]>
1 parent b714b5d commit 55bbdd7

File tree

5 files changed

+35
-0
lines changed

5 files changed

+35
-0
lines changed

doc/api/cli.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -737,6 +737,14 @@ Load an OpenSSL configuration file on startup. Among other uses, this can be
737737
used to enable FIPS-compliant crypto if Node.js is built
738738
against FIPS-enabled OpenSSL.
739739

740+
### `--openssl-legacy-provider`
741+
<!-- YAML
742+
added: REPLACEME
743+
-->
744+
745+
Enable OpenSSL 3.0 legacy provider. For more information please see
746+
[OSSL_PROVIDER-legacy][].
747+
740748
### `--pending-deprecation`
741749

742750
<!-- YAML
@@ -1597,6 +1605,7 @@ Node.js options that are allowed are:
15971605
* `--no-warnings`
15981606
* `--node-memory-debug`
15991607
* `--openssl-config`
1608+
* `--openssl-legacy-provider`
16001609
* `--pending-deprecation`
16011610
* `--policy-integrity`
16021611
* `--preserve-symlinks-main`
@@ -1957,6 +1966,7 @@ $ node --max-old-space-size=1536 index.js
19571966
[ECMAScript module loader]: esm.md#loaders
19581967
[Fetch API]: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API
19591968
[Modules loaders]: packages.md#modules-loaders
1969+
[OSSL_PROVIDER-legacy]: https://www.openssl.org/docs/man3.0/man7/OSSL_PROVIDER-legacy.html
19601970
[REPL]: repl.md
19611971
[ScriptCoverage]: https://chromedevtools.github.io/devtools-protocol/tot/Profiler#type-ScriptCoverage
19621972
[Source Map]: https://sourcemaps.info/spec.html

src/crypto/crypto_util.cc

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,16 @@ void InitCryptoOnce() {
153153
}
154154
#endif
155155

156+
#if OPENSSL_VERSION_MAJOR >= 3
157+
// --openssl-legacy-provider
158+
if (per_process::cli_options->openssl_legacy_provider) {
159+
OSSL_PROVIDER* legacy_provider = OSSL_PROVIDER_load(nullptr, "legacy");
160+
if (legacy_provider == nullptr) {
161+
fprintf(stderr, "Unable to load legacy provider.\n");
162+
}
163+
}
164+
#endif
165+
156166
OPENSSL_init_ssl(0, settings);
157167
OPENSSL_INIT_free(settings);
158168
settings = nullptr;

src/node_options.cc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@
55
#include "node_binding.h"
66
#include "node_external_reference.h"
77
#include "node_internals.h"
8+
#if HAVE_OPENSSL
9+
#include "openssl/opensslv.h"
10+
#endif
811

912
#include <errno.h>
1013
#include <sstream>

src/node_options.h

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@
1111
#include "node_mutex.h"
1212
#include "util.h"
1313

14+
#if HAVE_OPENSSL
15+
#include "openssl/opensslv.h"
16+
#endif
17+
1418
namespace node {
1519

1620
class HostPort {
@@ -252,6 +256,9 @@ class PerProcessOptions : public Options {
252256
bool enable_fips_crypto = false;
253257
bool force_fips_crypto = false;
254258
#endif
259+
#if OPENSSL_VERSION_MAJOR >= 3
260+
bool openssl_legacy_provider = false;
261+
#endif
255262

256263
// Per-process because reports can be triggered outside a known V8 context.
257264
bool report_on_fatalerror = false;

test/parallel/test-process-env-allowed-flags-are-documented.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,18 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
4343
}
4444
}
4545

46+
if (!common.hasOpenSSL3) {
47+
documented.delete('--openssl-legacy-provider');
48+
}
49+
4650
// Filter out options that are conditionally present.
4751
const conditionalOpts = [
4852
{
4953
include: common.hasCrypto,
5054
filter: (opt) => {
5155
return [
5256
'--openssl-config',
57+
common.hasOpenSSL3 ? '--openssl-legacy-provider' : '',
5358
'--tls-cipher-list',
5459
'--use-bundled-ca',
5560
'--use-openssl-ca',

0 commit comments

Comments
 (0)