Merge ~sergiodj/ubuntu/+source/nodejs:backport-openssl-legacy into ubuntu/+source/nodejs:ubuntu/devel

[Sergio Durigan Junior]

This MP adds support for the --openssl-legacy-provider option to nodejs.

This is hopefully the end of a rabbit hole that I got myself into after starting investigating why glewlwyd was FTBFSing during the openldap-2.6 transition mass test rebuild.

As it turns out, glewlwyd's FTBFS isn't related to openldap. What happens is that, during its build phase, it invokes webpack, and the webpack version we carry on Kinetic doesn't support newer crypto hashes. This means that, when it runs, it failes with:

(cd webapp-src && webpack --config webpack.config.js)
node:internal/crypto/hash:67
  this[kHandle] = new _Hash(algorithm, xofLen);
                  ^

Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:67:19)
    at Object.createHash (node:crypto:130:10)
    at module.exports (/usr/share/nodejs/webpack/lib/util/createHash.js:135:53)
    at NormalModule._initBuildHash (/usr/share/nodejs/webpack/lib/NormalModule.js:417:16)
    at handleParseError (/usr/share/nodejs/webpack/lib/NormalModule.js:471:10)
    at /usr/share/nodejs/webpack/lib/NormalModule.js:503:5
    at /usr/share/nodejs/webpack/lib/NormalModule.js:358:12
    at /usr/share/nodejs/loader-runner/lib/LoaderRunner.js:406:3
    at iterateNormalLoaders (/usr/share/nodejs/loader-runner/lib/LoaderRunner.js:232:10)
    at iterateNormalLoaders (/usr/share/nodejs/loader-runner/lib/LoaderRunner.js:239:10)
    at /usr/share/nodejs/loader-runner/lib/LoaderRunner.js:254:3
    at context.callback (/usr/share/nodejs/loader-runner/lib/LoaderRunner.js:124:13)
    at /<<PKGBUILDDIR>>/webapp-src/node_modules/babel-loader/lib/index.js:61:71 {
  opensslErrorStack: [ 'error:03000086:digital envelope routines::initialization error' ],
  library: 'digital envelope routines',
  reason: 'unsupported',
  code: 'ERR_OSSL_EVP_UNSUPPORTED'
}

I opened a bug against glewlwyd here: bug #1974107.

Anyway, in order to make openssl happy we need to enable legacy cyphers before we run webpack. One of the ways to do it is by specifying the option --openssl-legacy-provider to nodejs (via the NODE_OPTIONS env var), but unfortunately our version of nodejs (16) doesn't support this option yet. Fortunately, there is a PR available to implement this feature, and it's even been approved by upstream (but hasn't been merged yet).

I went ahead and backported the patch, which is relatively simple. There's a PPA with the proposed patch here:

https://launchpad.net/~sergiodj/+archive/ubuntu/nodejs-glewlwyd-openssl-fix

There you will find a built version of glewlwyd as well.

dep8 tests are still running, I will update this MP once I have the results.

[Sergio Durigan Junior (sergiodj)]

Adding a review spot for Gianfranco since he's been working on nodejs lately.

[Athos Ribeiro (athos-ribeiro)]

LGTM, as long as the armhf build and your dep8 tests are OK :)

For the DEP3 headers, you are missing the value for "Bug-Ubuntu" there.

Thanks for backporting this one!

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Thursday, May 19 2022, Athos Ribeiro wrote:

> LGTM, as long as the armhf build and your dep8 tests are OK :)

Thanks for the review, Athos.

I'm waiting on the armhf build (it'll take several hours, I'm afraid).
The ppc64el test failed, but I'm retriggering it here.

> For the DEP3 headers, you are missing the value for "Bug-Ubuntu" there.

Should be good now :-).

Cheers,

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Sergio Durigan Junior (sergiodj)]

On Thursday, May 19 2022, Sergio Durigan Junior wrote:

> On Thursday, May 19 2022, Athos Ribeiro wrote:
>
>> LGTM, as long as the armhf build and your dep8 tests are OK :)
>
> Thanks for the review, Athos.
>
> I'm waiting on the armhf build (it'll take several hours, I'm afraid).
> The ppc64el test failed, but I'm retriggering it here.

Everything seems to be fine, so I went ahead and uploaded it:

$ dput nodejs_16.14.2+dfsg1-1ubuntu3_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/nodejs/nodejs_16.14.2+dfsg1-1ubuntu3_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/nodejs/nodejs_16.14.2+dfsg1-1ubuntu3.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading nodejs_16.14.2+dfsg1-1ubuntu3.dsc: done.
  Uploading nodejs_16.14.2+dfsg1-1ubuntu3.debian.tar.xz: done.
  Uploading nodejs_16.14.2+dfsg1-1ubuntu3_source.buildinfo: done.
  Uploading nodejs_16.14.2+dfsg1-1ubuntu3_source.changes: done.
Successfully uploaded packages.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

Unmerged commits

835d45b... by Sergio Durigan Junior on 2022-05-19

changelog for 16.14.2+dfsg1-1ubuntu3

7713e69... by Sergio Durigan Junior on 2022-05-19

  * d/p/v16.x-backport-src-add-openssl-legacy-provider-optio.patch:
    Add support for --openssl-legacy-provider option. (LP: #1974226)

dad720b... by Gianfranco Costamagna on 2022-05-17

16.14.2+dfsg1-1ubuntu2 (patches unapplied)

Imported using git-ubuntu import.

diff --git a/debian/changelog b/debian/changelog
index 6d2d2b2..b23f69b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+nodejs (16.14.2+dfsg1-1ubuntu3) kinetic; urgency=medium
+
+  * d/p/v16.x-backport-src-add-openssl-legacy-provider-optio.patch:
+    Add support for --openssl-legacy-provider option. (LP: #1974226)
+
+ -- Sergio Durigan Junior <[e-mail]>  Thu, 19 May 2022 14:48:24 -0400
+
 nodejs (16.14.2+dfsg1-1ubuntu2) kinetic; urgency=medium
 
   * Merge from Debian unstable. Remaining changes:
diff --git a/debian/patches/series b/debian/patches/series
index eaad66a..bbb00e5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -19,3 +19,4 @@ mips/mipsel_is_32.patch
 build/skip-buffer-nan-internal-check.patch
 build/skip-crypto-engine-check.patch
 build/flaky-cpu-prof-riscv64.patch
+v16.x-backport-src-add-openssl-legacy-provider-optio.patch
diff --git a/debian/patches/v16.x-backport-src-add-openssl-legacy-provider-optio.patch b/debian/patches/v16.x-backport-src-add-openssl-legacy-provider-optio.patch
new file mode 100644
index 0000000..c630c26
--- /dev/null
+++ b/debian/patches/v16.x-backport-src-add-openssl-legacy-provider-optio.patch
@@ -0,0 +1,172 @@
+From: Daniel Bevenius <[e-mail]>
+Date: Sat, 16 Oct 2021 08:50:16 +0200
+Subject: [v16.x backport] src: add --openssl-legacy-provider option
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+This commit adds an option to Node.js named --openssl-legacy-provider
+and if specified will load OpenSSL 3.0 Legacy provider when dynamically
+linking Node.js v16.x with OpenSSL 3.0.
+
+Building:
+$ ./configure --shared-openssl \
+ --shared-openssl-libpath=/path/openssl_quic-3.0/lib64 \
+ --shared-openssl-includes=/path/openssl_quic-3.0/include \
+ --shared-openssl-libname=crypto,ssl
+$ make -j8
+
+Verify options is available:
+$ ./node --help
+...
+--openssl-legacy-provider  enable OpenSSL 3.0 legacy provider
+
+Usage:
+$ export LD_LIBRARY_PATH=/path/openssl_quic-3.0/lib64
+$ export OPENSSL_MODULES=/path/openssl_quic-3.0/lib64/ossl-modules/
+$ export OPENSSL_CONF=/path/openssl_quic-3.0/ssl/openssl.cnf
+$ ./node --openssl-legacy-provider  -p 'crypto.createHash("md4")'
+Hash {
+  _options: undefined,
+  [Symbol(kHandle)]: Hash {},
+  [Symbol(kState)]: { [Symbol(kFinalized)]: false }
+}
+
+Fixes: https://github.com/nodejs/node/issues/40948
+
+Refs: https://github.com/nodejs/node/issues/40455
+PR-URL: https://github.com/nodejs/node/pull/40478
+Reviewed-By: Richard Lau <[e-mail]>
+Reviewed-By: Tobias Nießen <[e-mail]>
+
+Forwarded: yes, https://github.com/nodejs/node/pull/42972
+Bug: https://github.com/nodejs/node/issues/40948
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/glewlwyd/+bug/1974107
+Reviewed-By: Sergio Durigan Junior <[e-mail]>
+---
+ doc/api/cli.md                                                | 11 +++++++++++
+ src/crypto/crypto_util.cc                                     | 10 ++++++++++
+ src/node_options.cc                                           |  3 +++
+ src/node_options.h                                            |  7 +++++++
+ .../parallel/test-process-env-allowed-flags-are-documented.js |  5 +++++
+ 5 files changed, 36 insertions(+)
+
+diff --git a/doc/api/cli.md b/doc/api/cli.md
+index 6c469ae..8c71f5d 100644
+--- a/doc/api/cli.md
++++ b/doc/api/cli.md
+@@ -714,6 +714,15 @@ Load an OpenSSL configuration file on startup. Among other uses, this can be
+ used to enable FIPS-compliant crypto if Node.js is built
+ against FIPS-enabled OpenSSL.
+ 
++### `--openssl-legacy-provider`
++
++<!-- YAML
++added: REPLACEME
++-->
++
++Enable OpenSSL 3.0 legacy provider when dynamically linking to OpenSSL 3.x.
++For more information please see [OSSL\_PROVIDER-legacy][OSSL_PROVIDER-legacy].
++
+ ### `--pending-deprecation`
+ 
+ <!-- YAML
+@@ -1571,6 +1580,7 @@ Node.js options that are allowed are:
+ * `--no-warnings`
+ * `--node-memory-debug`
+ * `--openssl-config`
++* `--openssl-legacy-provider`
+ * `--pending-deprecation`
+ * `--policy-integrity`
+ * `--preserve-symlinks-main`
+@@ -1930,6 +1940,7 @@ $ node --max-old-space-size=1536 index.js
+ [CommonJS]: modules.md
+ [ECMAScript module loader]: esm.md#loaders
+ [Modules loaders]: packages.md#modules-loaders
++[OSSL_PROVIDER-legacy]: https://www.openssl.org/docs/man3.0/man7/OSSL_PROVIDER-legacy.html
+ [REPL]: repl.md
+ [ScriptCoverage]: https://chromedevtools.github.io/devtools-protocol/tot/Profiler#type-ScriptCoverage
+ [Source Map]: https://sourcemaps.info/spec.html
+diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
+index e1ef170..e93edd4 100644
+--- a/src/crypto/crypto_util.cc
++++ b/src/crypto/crypto_util.cc
+@@ -148,6 +148,16 @@ void InitCryptoOnce() {
+   }
+ #endif
+ 
++#if OPENSSL_VERSION_MAJOR >= 3
++  // --openssl-legacy-provider
++  if (per_process::cli_options->openssl_legacy_provider) {
++    OSSL_PROVIDER* legacy_provider = OSSL_PROVIDER_load(nullptr, "legacy");
++    if (legacy_provider == nullptr) {
++      fprintf(stderr, "Unable to load legacy provider.\n");
++    }
++  }
++#endif
++
+   OPENSSL_init_ssl(0, settings);
+   OPENSSL_INIT_free(settings);
+   settings = nullptr;
+diff --git a/src/node_options.cc b/src/node_options.cc
+index cd537ad..e24fb3d 100644
+--- a/src/node_options.cc
++++ b/src/node_options.cc
+@@ -4,6 +4,9 @@
+ #include "env-inl.h"
+ #include "node_binding.h"
+ #include "node_internals.h"
++#if HAVE_OPENSSL
++#include "openssl/opensslv.h"
++#endif
+ 
+ #include <errno.h>
+ #include <sstream>
+diff --git a/src/node_options.h b/src/node_options.h
+index 5cf2bb4..90c6ce3 100644
+--- a/src/node_options.h
++++ b/src/node_options.h
+@@ -11,6 +11,10 @@
+ #include "node_mutex.h"
+ #include "util.h"
+ 
++#if HAVE_OPENSSL
++#include "openssl/opensslv.h"
++#endif
++
+ namespace node {
+ 
+ class HostPort {
+@@ -251,6 +255,9 @@ class PerProcessOptions : public Options {
+   bool enable_fips_crypto = false;
+   bool force_fips_crypto = false;
+ #endif
++#if OPENSSL_VERSION_MAJOR >= 3
++  bool openssl_legacy_provider = false;
++#endif
+ 
+   // Per-process because reports can be triggered outside a known V8 context.
+   bool report_on_fatalerror = false;
+diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
+index a2738f0..f4dd77e 100644
+--- a/test/parallel/test-process-env-allowed-flags-are-documented.js
++++ b/test/parallel/test-process-env-allowed-flags-are-documented.js
+@@ -43,6 +43,10 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
+   }
+ }
+ 
++if (!common.hasOpenSSL3) {
++  documented.delete('--openssl-legacy-provider');
++}
++
+ // Filter out options that are conditionally present.
+ const conditionalOpts = [
+   {
+@@ -50,6 +54,7 @@ const conditionalOpts = [
+     filter: (opt) => {
+       return [
+         '--openssl-config',
++        common.hasOpenSSL3 ? '--openssl-legacy-provider' : '',
+         '--tls-cipher-list',
+         '--use-bundled-ca',
+         '--use-openssl-ca',