Commit 24762a1
committed
deps: fix OpenSSL security level at 1
Node.js 22 was released with OpenSSL 3.0 which had a default security
level of 1. OpenSSL 3.2 bumped this to 2, but we need to fix this at
1 to minimize disruption to users of Node.js 22.x.
PR-URL: #59859
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>1 parent b8870c4 commit 24762a1
3 files changed
Lines changed: 22 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -26,6 +26,7 @@ | |||
| 26 | 26 | # is able to create a malicious DLL in one of the default search paths. | |
| 27 | 27 | 'OPENSSL_NO_HW', | |
| 28 | 28 | 'OPENSSL_API_COMPAT=0x10100001L', | |
| 29 | + 'OPENSSL_TLS_SECURITY_LEVEL=1', | ||
| 29 | 30 | 'STATIC_LEGACY', | |
| 30 | 31 | #'OPENSSL_NO_DEPRECATED', | |
| 31 | 32 | ], | |
@@ -62,6 +63,7 @@ | |||
| 62 | 63 | 'include_dirs+': ['openssl/apps/include'], | |
| 63 | 64 | 'defines': [ | |
| 64 | 65 | 'OPENSSL_API_COMPAT=0x10100001L', | |
| 66 | + 'OPENSSL_TLS_SECURITY_LEVEL=1', | ||
| 65 | 67 | #'OPENSSL_NO_DEPRECATED', | |
| 66 | 68 | ], | |
| 67 | 69 | 'conditions': [ | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -380,7 +380,10 @@ | |||
| 380 | 380 | 'defines': [ 'HAVE_OPENSSL=1' ], | |
| 381 | 381 | 'conditions': [ | |
| 382 | 382 | [ 'node_shared_openssl=="false"', { | |
| 383 | - 'defines': [ 'OPENSSL_API_COMPAT=0x10100000L', ], | ||
| 383 | + 'defines': [ | ||
| 384 | + 'OPENSSL_API_COMPAT=0x10100000L', | ||
| 385 | + 'OPENSSL_TLS_SECURITY_LEVEL=1', | ||
| 386 | + ], | ||
| 384 | 387 | 'dependencies': [ | |
| 385 | 388 | './deps/openssl/openssl.gyp:openssl', | |
| 386 | 389 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,16 @@ | |||
| 1 | + // Flags: --expose-internals | ||
| 2 | + 'use strict'; | ||
| 3 | + const common = require('../common'); | ||
| 4 | + if (!common.hasCrypto) | ||
| 5 | + common.skip('missing crypto'); | ||
| 6 | + | ||
| 7 | + if (process.config.variables.node_shared_openssl) | ||
| 8 | + common.skip('not applicable when dynamically linked to OpenSSL'); | ||
| 9 | + | ||
| 10 | + const secLevel = require('internal/crypto/util').getOpenSSLSecLevel(); | ||
| 11 | + const assert = require('assert'); | ||
| 12 | + | ||
| 13 | + // Node.js 22 was released with OpenSSL 3.0 which had a default security | ||
| 14 | + // level of 1. OpenSSL 3.2 bumped this to 2, but we need to fix this at | ||
| 15 | + // 1 to minimize disruption to users of Node.js 22.x. | ||
| 16 | + assert.strictEqual(secLevel, 1); | ||
0 commit comments