Skip to content

Commit 1ea0358

Browse files
indutnyrvagg
authored andcommitted
node: --openssl-config cli argument
Do not load `openssl.cnf` file automatically, load the one provided by `--openssl-config` at node startup. PR-URL: nodejs-private/node-private#78 Reviewed-By: Rod Vagg <rod@vagg.org>
1 parent 647afe9 commit 1ea0358

File tree

3 files changed

+31
-5
lines changed

3 files changed

+31
-5
lines changed

src/node.cc

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -169,11 +169,14 @@ static const char* icu_data_dir = nullptr;
169169
// used by C++ modules as well
170170
bool no_deprecation = false;
171171

172-
#if HAVE_OPENSSL && NODE_FIPS_MODE
172+
#if HAVE_OPENSSL
173+
# if NODE_FIPS_MODE
173174
// used by crypto module
174175
bool enable_fips_crypto = false;
175176
bool force_fips_crypto = false;
176-
#endif
177+
# endif // NODE_FIPS_MODE
178+
const char* openssl_config = nullptr;
179+
#endif // HAVE_OPENSSL
177180

178181
// true if process warnings should be suppressed
179182
bool no_process_warnings = false;
@@ -3637,6 +3640,8 @@ static void PrintHelp() {
36373640
" --enable-fips enable FIPS crypto at startup\n"
36383641
" --force-fips force FIPS crypto (cannot be disabled)\n"
36393642
#endif /* NODE_FIPS_MODE */
3643+
" --openssl-config=path load OpenSSL configuration file from the\n"
3644+
" specified path\n"
36403645
#endif /* HAVE_OPENSSL */
36413646
#if defined(NODE_HAVE_I18N_SUPPORT)
36423647
" --icu-data-dir=dir set ICU data load path to dir\n"
@@ -3797,6 +3802,8 @@ static void ParseArgs(int* argc,
37973802
} else if (strcmp(arg, "--force-fips") == 0) {
37983803
force_fips_crypto = true;
37993804
#endif /* NODE_FIPS_MODE */
3805+
} else if (strncmp(arg, "--openssl-config=", 17) == 0) {
3806+
openssl_config = arg + 17;
38003807
#endif /* HAVE_OPENSSL */
38013808
#if defined(NODE_HAVE_I18N_SUPPORT)
38023809
} else if (strncmp(arg, "--icu-data-dir=", 15) == 0) {

src/node.h

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -179,10 +179,13 @@ typedef intptr_t ssize_t;
179179
namespace node {
180180

181181
NODE_EXTERN extern bool no_deprecation;
182-
#if HAVE_OPENSSL && NODE_FIPS_MODE
182+
#if HAVE_OPENSSL
183+
# if NODE_FIPS_MODE
183184
NODE_EXTERN extern bool enable_fips_crypto;
184185
NODE_EXTERN extern bool force_fips_crypto;
185-
#endif
186+
# endif // NODE_FIPS_MODE
187+
NODE_EXTERN extern const char* openssl_config;
188+
#endif // HAVE_OPENSSL
186189

187190
NODE_EXTERN int Start(int argc, char *argv[]);
188191
NODE_EXTERN void Init(int* argc,

src/node_crypto.cc

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5789,7 +5789,23 @@ void TimingSafeEqual(const FunctionCallbackInfo<Value>& args) {
57895789
}
57905790

57915791
void InitCryptoOnce() {
5792-
OPENSSL_config(NULL);
5792+
OPENSSL_no_config();
5793+
5794+
// --openssl-config=...
5795+
if (openssl_config != nullptr) {
5796+
CONF_modules_load_file(
5797+
openssl_config,
5798+
nullptr,
5799+
CONF_MFLAGS_DEFAULT_SECTION | CONF_MFLAGS_IGNORE_MISSING_FILE);
5800+
int err = ERR_get_error();
5801+
if (0 != err) {
5802+
fprintf(stderr,
5803+
"openssl config failed: %s\n",
5804+
ERR_error_string(err, NULL));
5805+
CHECK_NE(err, 0);
5806+
}
5807+
}
5808+
57935809
SSL_library_init();
57945810
OpenSSL_add_all_algorithms();
57955811
SSL_load_error_strings();

0 commit comments

Comments
 (0)