FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

crypto: support OPENSSL_CONF again · nodejs/node@a3bf4a2 · GitHub

/ node Public

Commit a3bf4a2

Browse files
sam-github
committed
crypto: support OPENSSL_CONF again
A side-effect of https://github.com/nodejs/node-private/pull/82 was to remove support for OPENSSL_CONF, as well as removing the default read of a configuration file on startup. Partly revert this, allowing OPENSSL_CONF to be used to specify a configuration file to read on startup, but do not read a file by default. If the --openssl-config command line option is provided, its value is used, not the OPENSSL_CONF environment variable. Fix: #10938 PR-URL: #11006 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
1 parent dc77c6e commit a3bf4a2

6 files changed

Lines changed: 58 additions & 10 deletions

File tree

‎doc/api/cli.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -363,6 +363,18 @@ misformatted, but any errors are otherwise ignored.
363363
Note that neither the well known nor extra certificates are used when the `ca`
364364
options property is explicitly specified for a TLS or HTTPS client or server.
365365

366+
### `OPENSSL_CONF=file`
367+
<!-- YAML
368+
added: REPLACEME
369+
-->
370+
371+
Load an OpenSSL configuration file on startup. Among other uses, this can be
372+
used to enable FIPS-compliant crypto if Node.js is built with `./configure
373+
\-\-openssl\-fips`.
374+
375+
If the [`--openssl-config`][] command line option is used, the environment
376+
variable is ignored.
377+
366378
### `SSL_CERT_DIR=dir`
367379

368380
If `--use-openssl-ca` is enabled, this overrides and sets OpenSSL's directory
@@ -386,3 +398,4 @@ OpenSSL, it may cause them to trust the same CAs as node.
386398
[debugger]: debugger.html
387399
[REPL]: repl.html
388400
[SlowBuffer]: buffer.html#buffer_class_slowbuffer
401+
[`--openssl-config`]: #cli_openssl_config_file

‎doc/node.1‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,16 @@ asynchronous when outputting to a TTY on platforms which support async stdio.
243243
Setting this will void any guarantee that stdio will not be interleaved or
244244
dropped at program exit. \fBAvoid use.\fR
245245

246+
.TP
247+
.BR OPENSSL_CONF = \fIfile\fR
248+
Load an OpenSSL configuration file on startup. Among other uses, this can be
249+
used to enable FIPS-compliant crypto if Node.js is built with
250+
\fB./configure \-\-openssl\-fips\fR.
251+
252+
If the
253+
\fB\-\-openssl\-config\fR
254+
command line option is used, the environment variable is ignored.
255+
246256
.TP
247257
.BR SSL_CERT_DIR = \fIdir\fR
248258
If \fB\-\-use\-openssl\-ca\fR is enabled, this overrides and sets OpenSSL's directory

‎src/node.cc‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@ bool ssl_openssl_cert_store =
174174
bool enable_fips_crypto = false;
175175
bool force_fips_crypto = false;
176176
# endif // NODE_FIPS_MODE
177-
const char* openssl_config = nullptr;
177+
std::string openssl_config; // NOLINT(runtime/string)
178178
#endif // HAVE_OPENSSL
179179

180180
// true if process warnings should be suppressed
@@ -3519,8 +3519,9 @@ static void PrintHelp() {
35193519
" --enable-fips enable FIPS crypto at startup\n"
35203520
" --force-fips force FIPS crypto (cannot be disabled)\n"
35213521
#endif /* NODE_FIPS_MODE */
3522-
" --openssl-config=path load OpenSSL configuration file from\n"
3523-
" the specified path\n"
3522+
" --openssl-config=file load OpenSSL configuration from the\n"
3523+
" specified file (overrides\n"
3524+
" OPENSSL_CONF)\n"
35243525
#endif /* HAVE_OPENSSL */
35253526
#if defined(NODE_HAVE_I18N_SUPPORT)
35263527
" --icu-data-dir=dir set ICU data load path to dir\n"
@@ -3553,6 +3554,8 @@ static void PrintHelp() {
35533554
" prefixed to the module search path\n"
35543555
"NODE_REPL_HISTORY path to the persistent REPL history\n"
35553556
" file\n"
3557+
"OPENSSL_CONF load OpenSSL configuration from file\n"
3558+
"\n"
35563559
"Documentation can be found at https://nodejs.org/\n");
35573560
}
35583561

@@ -3690,7 +3693,7 @@ static void ParseArgs(int* argc,
36903693
force_fips_crypto = true;
36913694
#endif /* NODE_FIPS_MODE */
36923695
} else if (strncmp(arg, "--openssl-config=", 17) == 0) {
3693-
openssl_config = arg + 17;
3696+
openssl_config.assign(arg + 17);
36943697
#endif /* HAVE_OPENSSL */
36953698
#if defined(NODE_HAVE_I18N_SUPPORT)
36963699
} else if (strncmp(arg, "--icu-data-dir=", 15) == 0) {
@@ -4187,6 +4190,9 @@ void Init(int* argc,
41874190
SafeGetenv("NODE_PRESERVE_SYMLINKS", &text) && text[0] == '1';
41884191
}
41894192

4193+
if (openssl_config.empty())
4194+
SafeGetenv("OPENSSL_CONF", &openssl_config);
4195+
41904196
// Parse a few arguments which are specific to Node.
41914197
int v8_argc;
41924198
const char** v8_argv;

‎src/node_crypto.cc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5881,14 +5881,14 @@ void InitCryptoOnce() {
58815881
OPENSSL_no_config();
58825882

58835883
// --openssl-config=...
5884-
if (openssl_config != nullptr) {
5884+
if (!openssl_config.empty()) {
58855885
OPENSSL_load_builtin_modules();
58865886
#ifndef OPENSSL_NO_ENGINE
58875887
ENGINE_load_builtin_engines();
58885888
#endif
58895889
ERR_clear_error();
58905890
CONF_modules_load_file(
5891-
openssl_config,
5891+
openssl_config.c_str(),
58925892
nullptr,
58935893
CONF_MFLAGS_DEFAULT_SECTION);
58945894
int err = ERR_get_error();

‎src/node_internals.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ namespace node {
3636

3737
// Set in node.cc by ParseArgs with the value of --openssl-config.
3838
// Used in node_crypto.cc when initializing OpenSSL.
39-
extern const char* openssl_config;
39+
extern std::string openssl_config;
4040

4141
// Set in node.cc by ParseArgs when --preserve-symlinks is used.
4242
// Used in node_config.cc to set a constant on process.binding('config')

‎test/parallel/test-crypto-fips.js‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,9 @@ function testHelper(stream, args, expectedOutput, cmd, env) {
3737
env: env
3838
});
3939

40-
console.error('Spawned child [pid:' + child.pid + '] with cmd ' +
41-
cmd + ' and args \'' + args + '\'');
40+
console.error('Spawned child [pid:' + child.pid + '] with cmd \'' +
41+
cmd + '\' expect %j with args \'' + args + '\'' +
42+
' OPENSSL_CONF=%j', expectedOutput, env.OPENSSL_CONF);
4243

4344
function childOk(child) {
4445
console.error('Child #' + ++num_children_ok +
@@ -92,10 +93,26 @@ testHelper(
9293
compiledWithFips() ? FIPS_ENABLED : FIPS_DISABLED,
9394
'require("crypto").fips',
9495
process.env);
95-
// OPENSSL_CONF should _not_ be able to turn on FIPS mode
96+
97+
// OPENSSL_CONF should be able to turn on FIPS mode
9698
testHelper(
9799
'stdout',
98100
[],
101+
compiledWithFips() ? FIPS_ENABLED : FIPS_DISABLED,
102+
'require("crypto").fips',
103+
addToEnv('OPENSSL_CONF', CNF_FIPS_ON));
104+
105+
// --openssl-config option should override OPENSSL_CONF
106+
testHelper(
107+
'stdout',
108+
[`--openssl-config=${CNF_FIPS_ON}`],
109+
compiledWithFips() ? FIPS_ENABLED : FIPS_DISABLED,
110+
'require("crypto").fips',
111+
addToEnv('OPENSSL_CONF', CNF_FIPS_OFF));
112+
113+
testHelper(
114+
'stdout',
115+
[`--openssl-config=${CNF_FIPS_OFF}`],
99116
FIPS_DISABLED,
100117
'require("crypto").fips',
101118
addToEnv('OPENSSL_CONF', CNF_FIPS_ON));
@@ -107,6 +124,7 @@ testHelper(
107124
compiledWithFips() ? FIPS_ENABLED : OPTION_ERROR_STRING,
108125
'require("crypto").fips',
109126
process.env);
127+
110128
// OPENSSL_CONF should _not_ make a difference to --enable-fips
111129
testHelper(
112130
compiledWithFips() ? 'stdout' : 'stderr',
@@ -122,6 +140,7 @@ testHelper(
122140
compiledWithFips() ? FIPS_ENABLED : OPTION_ERROR_STRING,
123141
'require("crypto").fips',
124142
process.env);
143+
125144
// Using OPENSSL_CONF should not make a difference to --force-fips
126145
testHelper(
127146
compiledWithFips() ? 'stdout' : 'stderr',

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL