src,deps,build,test: add OpenSSL config appname by danbev · Pull Request #43124 · nodejs/node

danbev · 2022-05-17T12:01:56Z

This commit adds the setting of an appname (configuration section
name), nodejs_conf, to be used when reading OpenSSL configuration
files.

The motivation for this is that currently the default OpenSSL
configuration, openssl_conf, element will be used which may be
undesirable as it might configure OpenSSL in unwanted ways. With this
commit it is still possible to use a default openssl.cnf file but the
only section that Node.js will read from is a section named
nodejs_conf.

Refs: #40366

nodejs-github-bot · 2022-05-17T12:02:00Z

Review requested:

@nodejs/gyp
@nodejs/startup

nodejs-github-bot · 2022-05-17T12:18:53Z

CI: https://ci.nodejs.org/job/node-test-pull-request/44049/

mhdawson · 2022-05-17T13:08:25Z

@danbev this will be breaking for anybody currently depending on the default config right?

danbev · 2022-05-17T13:10:04Z

this will be breaking for anybody currently depending on the default config right?

Yeah, this will probably break for them and they would have to copy, or rename, the default section/appname from openssl_conf to nodejs_conf.

BethGriggs

Could/should we also add a flag to allow the old behaviour of loading from the shared section of the OpenSSL config? (maybe --openssl-shared-config or something more suitably named?)

danbev · 2022-05-18T09:02:55Z

Could/should we also add a flag to allow the old behaviour of loading from the shared section of the OpenSSL config? (maybe --openssl-shared-config or something more suitably named?)

82c3f44 contains your suggestion (at least my interpretation :) for adding such a flag.

nodejs-github-bot · 2022-05-18T10:55:12Z

CI: https://ci.nodejs.org/job/node-test-pull-request/44060/

nodejs-github-bot · 2022-05-18T12:52:22Z

CI: https://ci.nodejs.org/job/node-test-pull-request/44063/

nodejs-github-bot · 2022-05-18T18:39:56Z

CI: https://ci.nodejs.org/job/node-test-pull-request/44073/

nodejs-github-bot · 2022-05-24T03:53:44Z

CI: https://ci.nodejs.org/job/node-test-pull-request/44143/

This commit adds the setting of an appname (configuration section name), 'nodejs_conf', to be used when reading OpenSSL configuration files. The motivation for this is that currently the default OpenSSL configuration, 'openssl_conf', element will be used which may be undesirable as it might configure OpenSSL in unwanted ways. With this commit it is still possible to use a default openssl.cnf file but the only section that Node.js will read from is a section named 'nodejs_conf'. PR-URL: #43124 Refs: #40366 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>

This commit adds a new command line option named '--openssl-shared-config' intended to allow reverting to the old OpenSSL configuration behavior where Node.js would use the configuration section name (called appname in OpenSSL) 'openssl_conf' which could potentially be used my other applications.. PR-URL: #43124 Refs: #40366 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>

Notable changes: * crypto: * remove Node.js-specific webcrypto extensions (Filip Skokan) nodejs#43310 * add CFRG curves to Web Crypto API (Filip Skokan) nodejs#42507 * report: * add more heap infos in process report (theanarkh) nodejs#43116 * src: * add --openssl-shared-config option (Daniel Bevenius) nodejs#43124 * add OpenSSL config appname (Daniel Bevenius) nodejs#43124 * add initial shadow realm support (Chengzhong Wu) nodejs#42869 PR-URL: nodejs#43385

RafaelGSS · 2022-06-20T17:23:08Z

@danbev Do you think would be possible to backport it to v14.x and v16.x? I'm just asking because those release lines use OpenSSL 1.1.1n

danbev · 2022-06-22T05:35:29Z

Do you think would be possible to backport it to v14.x and v16.x?

It might be possible but I think it would probably require a little work as I don't think the commit would land cleanly. I'll take a closer look and see if this is feasible. I've looked at v16.x and this should be possible. I've done some manual tests which work as expected, but there is a test that fails, test-crypto-fips, and it will needs some more work to get this working, perhaps both in the tests and in changes to the code in src/node.cc.

This commit adds the setting of an appname (configuration section name), 'nodejs_conf', to be used when reading OpenSSL configuration files. The motivation for this is that currently the default OpenSSL configuration, 'openssl_conf', element will be used which may be undesirable as it might configure OpenSSL in unwanted ways. With this commit it is still possible to use a default openssl.cnf file but the only section that Node.js will read from is a section named 'nodejs_conf'. PR-URL: nodejs#43124 Refs: nodejs#40366 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>

This commit adds a new command line option named '--openssl-shared-config' intended to allow reverting to the old OpenSSL configuration behavior where Node.js would use the configuration section name (called appname in OpenSSL) 'openssl_conf' which could potentially be used my other applications.. PR-URL: nodejs#43124 Refs: nodejs#40366 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>

This commit adds the setting of an appname (configuration section name), 'nodejs_conf', to be used when reading OpenSSL configuration files. The motivation for this is that currently the default OpenSSL configuration, 'openssl_conf', element will be used which may be undesirable as it might configure OpenSSL in unwanted ways. With this commit it is still possible to use a default openssl.cnf file but the only section that Node.js will read from is a section named 'nodejs_conf'. PR-URL: nodejs#43124 Refs: nodejs#40366 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>

nodejs-github-bot added lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels May 17, 2022

addaleax reviewed May 17, 2022
View reviewed changes

Comment threadsrc/node.cc Outdated

mscdex added the semver-major PRs that contain breaking changes and should be released in the next major version. label May 17, 2022

BethGriggs reviewed May 17, 2022
View reviewed changes

github-actionsBot mentioned this pull request May 18, 2022
CI Reliability 2022-05-18 nodejs/reliability#281
Open
28 tasks

danbev force-pushed the openssl_nodejs_conf branch from b718d95 to 59870a3Compare May 18, 2022 04:12

jasnell approved these changes May 18, 2022
View reviewed changes

Trott approved these changes May 18, 2022
View reviewed changes

RafaelGSS reviewed May 18, 2022
View reviewed changes

Comment threadsrc/node.cc Outdated
Comment threadBUILDING.md Outdated

This was referenced May 19, 2022
CI Reliability 2022-05-19 nodejs/reliability#282
Open
CI Reliability 2022-05-20 nodejs/reliability#283
Open
CI Reliability 2022-05-21 nodejs/reliability#284
Open
CI Reliability 2022-05-22 nodejs/reliability#285
Open

danbev added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label May 22, 2022

github-actionsBot mentioned this pull request May 23, 2022
CI Reliability 2022-05-23 nodejs/reliability#286
Open
20 tasks

RafaelGSS approved these changes May 23, 2022
View reviewed changes

BethGriggs added the notable-change PRs with changes that should be highlighted in changelogs. label May 23, 2022

BethGriggs reviewed May 23, 2022
View reviewed changes

Comment threadBUILDING.md Outdated

BethGriggs approved these changes May 23, 2022
View reviewed changes

github-actionsBot mentioned this pull request May 24, 2022
CI Reliability 2022-05-24 nodejs/reliability#287
Open
20 tasks

This was referenced Jun 3, 2022
CI Reliability 2022-06-03 nodejs/reliability#297
Open
CI Reliability 2022-06-04 nodejs/reliability#298
Open

danielleadams mentioned this pull request Jun 11, 2022
v18.4.0 proposal #43385
Merged

RafaelGSS mentioned this pull request Jun 22, 2022
[v18.x] src,deps,build,test: add OpenSSL config appname #43539
Closed

danbev mentioned this pull request Jun 23, 2022
[v16.x backport] src,deps,build,test: add OpenSSL config appname #43545
Closed

danbev mentioned this pull request Jun 27, 2022
[v14.x backport] src,deps,build,test: add OpenSSL config appname #43586
Closed

BethGriggs mentioned this pull request Jul 8, 2022
doc: add details for July 2022 security releases #43733
Closed
2 tasks

This was referenced Jul 11, 2022
[v14.x] src,doc,test: add --openssl-shared-config option #43782
Closed
[v16.x] src,doc,test: add --openssl-shared-config option #43783
Closed
[v16.x] src,doc,test: add --openssl-shared-config option #43892
Closed

targos mentioned this pull request Aug 2, 2022
v16.17.0 release proposal #44098
Merged

danielleadams mentioned this pull request Oct 4, 2022
v14.21.0 proposal #44889
Merged

ckcr4lyf mentioned this pull request May 23, 2023
openssl-legacy-provider CLI argument doesn't seem to work as expected #47379
Closed

richardlau mentioned this pull request Jul 28, 2023
Draft: Keep FIPS provider #48950
Closed

richardlau mentioned this pull request Sep 11, 2023
SECLEVEL set via ciphers option is applied too late in tls.createSecureContext #36655
Closed

giuliohome mentioned this pull request Feb 28, 2024
[BUG] npm fails to install package npm ERR! errno EPROTO npm/cli#6070
Closed
2 tasks

Uh oh!

Uh oh!

Conversation

danbev commented May 17, 2022

Uh oh!

nodejs-github-bot commented May 17, 2022

Uh oh!

nodejs-github-bot commented May 17, 2022

Uh oh!

Uh oh!

mhdawson commented May 17, 2022

Uh oh!

danbev commented May 17, 2022

Uh oh!

BethGriggs left a comment

Choose a reason for hiding this comment

Uh oh!

danbev commented May 18, 2022

Uh oh!

nodejs-github-bot commented May 18, 2022

Uh oh!

nodejs-github-bot commented May 18, 2022

Uh oh!

nodejs-github-bot commented May 18, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nodejs-github-bot commented May 24, 2022

Uh oh!

RafaelGSS commented Jun 20, 2022

Uh oh!

danbev commented Jun 22, 2022• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

danbev commented Jun 22, 2022•
edited
Loading