Skip to content

Add build option for distributions in which nodejs uses systems openssl instead of the bundled one #60270

@tjuhaszrh

Description

@tjuhaszrh

What is the problem this feature will solve?

Linux distributions (Like RHEL/Fedora family) have issues in which certain API calls like:

  • --force-fips
  • --enable-fips

Will lead to segfaults ->

./node --force-fips -p 'crypto.getFips()'
./node[495774]: ../src/node.cc:1070:std::unique_ptr<node::InitializationResultImpl> node::InitializeOncePerProcessInternal(const std::vector<std::__cxx11::basic_string<char> >&, ProcessInitializationFlags::Flags): Assertion `crypto::CSPRNG(nullptr, 0).is_ok()' failed.
 1: 0xc0e140 node::Abort() [./node]
 2: 0xc0e1be  [./node]
 3: 0xbc7af0  [./node]
 4: 0xbc7ffc node::Start(int, char**) [./node]
 5: 0x7f7f7ba49b4a  [/lib64/libc.so.6]
 6: 0x7f7f7ba49c0b __libc_start_main [/lib64/libc.so.6]
 7: 0xb22925 _start [./node]
[1]    496569 IOT instruction (core dumped)  ./node --force-fips -p 'crypto.getFips()'

This happens due to the expectation of nodejs to use openssl which was originally bundled and then in this distribution removed during the packaging process.
These distributions use the systems openssl instead which creates differences in expected behaviour.

Further details of the issue were previously discussed in abandoned draft.

What is the feature you are proposing to solve the problem?

Basically the build configuration flag suggested in this draft.

Allowing distributions to disable this problematic API calls and documenting this possible difference in official nodejs API docs would be really helpful.

What alternatives have you considered?

Metadata

Metadata

Assignees

No one assigned

    Labels

    feature requestIssues that request new features to be added to Node.js.

    Type

    No type

    Projects

    Status

    Awaiting Triage

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions