src,deps,build,test: add OpenSSL config appname by danbev · Pull Request #43124 · nodejs/node · GitHub

This commit adds the setting of an appname (configuration section
name), nodejs_conf, to be used when reading OpenSSL configuration
files.

The motivation for this is that currently the default OpenSSL
configuration, openssl_conf, element will be used which may be
undesirable as it might configure OpenSSL in unwanted ways. With this
commit it is still possible to use a default openssl.cnf file but the
only section that Node.js will read from is a section named
nodejs_conf.

Refs: #40366

Review requested:

@nodejs/gyp
@nodejs/startup

CI: https://ci.nodejs.org/job/node-test-pull-request/44049/

@danbev this will be breaking for anybody currently depending on the default config right?

this will be breaking for anybody currently depending on the default config right?

Yeah, this will probably break for them and they would have to copy, or rename, the default section/appname from openssl_conf to nodejs_conf.

Could/should we also add a flag to allow the old behaviour of loading from the shared section of the OpenSSL config? (maybe --openssl-shared-config or something more suitably named?)

Could/should we also add a flag to allow the old behaviour of loading from the shared section of the OpenSSL config? (maybe --openssl-shared-config or something more suitably named?)

82c3f44 contains your suggestion (at least my interpretation :) for adding such a flag.

CI: https://ci.nodejs.org/job/node-test-pull-request/44060/

CI: https://ci.nodejs.org/job/node-test-pull-request/44063/

CI: https://ci.nodejs.org/job/node-test-pull-request/44073/

CI: https://ci.nodejs.org/job/node-test-pull-request/44143/

This commit adds the setting of an appname (configuration section name), 'nodejs_conf', to be used when reading OpenSSL configuration files. The motivation for this is that currently the default OpenSSL configuration, 'openssl_conf', element will be used which may be undesirable as it might configure OpenSSL in unwanted ways. With this commit it is still possible to use a default openssl.cnf file but the only section that Node.js will read from is a section named 'nodejs_conf'. PR-URL: #43124 Refs: #40366 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>

This commit adds a new command line option named '--openssl-shared-config' intended to allow reverting to the old OpenSSL configuration behavior where Node.js would use the configuration section name (called appname in OpenSSL) 'openssl_conf' which could potentially be used my other applications.. PR-URL: #43124 Refs: #40366 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>

Notable changes: * crypto: * remove Node.js-specific webcrypto extensions (Filip Skokan) nodejs#43310 * add CFRG curves to Web Crypto API (Filip Skokan) nodejs#42507 * report: * add more heap infos in process report (theanarkh) nodejs#43116 * src: * add --openssl-shared-config option (Daniel Bevenius) nodejs#43124 * add OpenSSL config appname (Daniel Bevenius) nodejs#43124 * add initial shadow realm support (Chengzhong Wu) nodejs#42869 PR-URL: nodejs#43385

@danbev Do you think would be possible to backport it to v14.x and v16.x? I'm just asking because those release lines use OpenSSL 1.1.1n

Do you think would be possible to backport it to v14.x and v16.x?

It might be possible but I think it would probably require a little work as I don't think the commit would land cleanly. I'll take a closer look and see if this is feasible. I've looked at v16.x and this should be possible. I've done some manual tests which work as expected, but there is a test that fails, test-crypto-fips, and it will needs some more work to get this working, perhaps both in the tests and in changes to the code in src/node.cc.

This commit adds the setting of an appname (configuration section name), 'nodejs_conf', to be used when reading OpenSSL configuration files. The motivation for this is that currently the default OpenSSL configuration, 'openssl_conf', element will be used which may be undesirable as it might configure OpenSSL in unwanted ways. With this commit it is still possible to use a default openssl.cnf file but the only section that Node.js will read from is a section named 'nodejs_conf'. PR-URL: nodejs#43124 Refs: nodejs#40366 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>

This commit adds a new command line option named '--openssl-shared-config' intended to allow reverting to the old OpenSSL configuration behavior where Node.js would use the configuration section name (called appname in OpenSSL) 'openssl_conf' which could potentially be used my other applications.. PR-URL: nodejs#43124 Refs: nodejs#40366 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>

This commit adds the setting of an appname (configuration section name), 'nodejs_conf', to be used when reading OpenSSL configuration files. The motivation for this is that currently the default OpenSSL configuration, 'openssl_conf', element will be used which may be undesirable as it might configure OpenSSL in unwanted ways. With this commit it is still possible to use a default openssl.cnf file but the only section that Node.js will read from is a section named 'nodejs_conf'. PR-URL: nodejs#43124 Refs: nodejs#40366 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>

nodejs-github-bot added lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels May 17, 2022

addaleax reviewed May 17, 2022

View reviewed changes

Comment thread src/node.cc Outdated

mscdex added the semver-major PRs that contain breaking changes and should be released in the next major version. label May 17, 2022

BethGriggs reviewed May 17, 2022

View reviewed changes

github-actions Bot mentioned this pull request May 18, 2022

CI Reliability 2022-05-18 nodejs/reliability#281

Open

28 tasks

danbev force-pushed the openssl_nodejs_conf branch from b718d95 to 59870a3 Compare May 18, 2022 04:12

jasnell approved these changes May 18, 2022

View reviewed changes

Trott approved these changes May 18, 2022

View reviewed changes

RafaelGSS reviewed May 18, 2022

View reviewed changes

Comment thread src/node.cc Outdated

Comment thread BUILDING.md Outdated

This was referenced May 19, 2022

CI Reliability 2022-05-19 nodejs/reliability#282

Open

CI Reliability 2022-05-20 nodejs/reliability#283

Open

CI Reliability 2022-05-21 nodejs/reliability#284

Open

CI Reliability 2022-05-22 nodejs/reliability#285

Open

danbev added the author ready PRs that have at least one approval, no outstanding review comments, and a CI started. label May 22, 2022

github-actions Bot mentioned this pull request May 23, 2022

CI Reliability 2022-05-23 nodejs/reliability#286

Open

20 tasks

RafaelGSS approved these changes May 23, 2022

View reviewed changes

BethGriggs added the notable-change PRs with changes that should be highlighted in changelogs. label May 23, 2022

BethGriggs reviewed May 23, 2022

View reviewed changes

Comment thread BUILDING.md Outdated

BethGriggs approved these changes May 23, 2022

View reviewed changes

github-actions Bot mentioned this pull request May 24, 2022

CI Reliability 2022-05-24 nodejs/reliability#287

Open

20 tasks

This was referenced Jun 3, 2022

CI Reliability 2022-06-03 nodejs/reliability#297

Open

CI Reliability 2022-06-04 nodejs/reliability#298

Open

danielleadams mentioned this pull request Jun 11, 2022

v18.4.0 proposal #43385

Merged

RafaelGSS mentioned this pull request Jun 22, 2022

[v18.x] src,deps,build,test: add OpenSSL config appname #43539

Closed

danbev mentioned this pull request Jun 23, 2022

[v16.x backport] src,deps,build,test: add OpenSSL config appname #43545

Closed

danbev mentioned this pull request Jun 27, 2022

[v14.x backport] src,deps,build,test: add OpenSSL config appname #43586

Closed

BethGriggs mentioned this pull request Jul 8, 2022

doc: add details for July 2022 security releases #43733

Closed

2 tasks

This was referenced Jul 11, 2022

[v14.x] src,doc,test: add --openssl-shared-config option #43782

Closed

[v16.x] src,doc,test: add --openssl-shared-config option #43783

Closed

[v16.x] src,doc,test: add --openssl-shared-config option #43892

Closed

targos mentioned this pull request Aug 2, 2022

v16.17.0 release proposal #44098

Merged

danielleadams mentioned this pull request Oct 4, 2022

v14.21.0 proposal #44889

Merged

ckcr4lyf mentioned this pull request May 23, 2023

openssl-legacy-provider CLI argument doesn't seem to work as expected #47379

Closed

richardlau mentioned this pull request Jul 28, 2023

Draft: Keep FIPS provider #48950

Closed

richardlau mentioned this pull request Sep 11, 2023

SECLEVEL set via ciphers option is applied too late in tls.createSecureContext #36655

Closed

giuliohome mentioned this pull request Feb 28, 2024

[BUG] npm fails to install package npm ERR! errno EPROTO npm/cli#6070

Closed

2 tasks

src,deps,build,test: add OpenSSL config appname by danbev · Pull Request #43124 · nodejs/node · GitHub

Uh oh!

Uh oh!

src,deps,build,test: add OpenSSL config appname - #43124

src,deps,build,test: add OpenSSL config appname#43124danbev wants to merge 2 commits intonodejs:masternodejs/node:masterfrom danbev:openssl_nodejs_confdanbev/node:openssl_nodejs_confCopy head branch name to clipboard

Conversation

danbev commented May 17, 2022

Uh oh!

nodejs-github-bot commented May 17, 2022

Uh oh!

nodejs-github-bot commented May 17, 2022

Uh oh!

Uh oh!

mhdawson commented May 17, 2022

Uh oh!

danbev commented May 17, 2022

Uh oh!

BethGriggs left a comment

Choose a reason for hiding this comment

Uh oh!

danbev commented May 18, 2022

Uh oh!

nodejs-github-bot commented May 18, 2022

Uh oh!

nodejs-github-bot commented May 18, 2022

Uh oh!

nodejs-github-bot commented May 18, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nodejs-github-bot commented May 24, 2022

Uh oh!

RafaelGSS commented Jun 20, 2022

Uh oh!

danbev commented Jun 22, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

src,deps,build,test: add OpenSSL config appname#43124
danbev wants to merge 2 commits into
nodejs:masterfrom
danbev:openssl_nodejs_conf

danbev commented Jun 22, 2022 •
edited
Loading