Bug 1842826

There was related discussion of interested parties going on via e-mail; pasting it here so we can find it later.

Also, I'm adding the mentioned people to the CC of this bug; let's continue the discussion here.

---

From jstanek:
> Hi all,
> while waiting for Node 14 test suite run to finish, I decided to take a
> look at the situation there. After a bit of poking, this is what I gathered:
>
> 1. The SSL_CTX_set_cipher_list call is wrapped and provided as a part of
> TLS API of Node – that by itself should be fine; users should be allowed
> to set their own ciphers.
>
> 2. The default value for this call was a bit tricky to find, but I think
> it comes from DEFAULT_CIPHER_LIST_CORE in `src/node_constants.h`. The
> value in Node 14 is a hard-coded list of ciphers; I did not check,
> but I assume that is not the same as the system policy, and it will
> definitely not follow it in case it changes.
>
> So, if I understood the police correctly, we want to change this
> constant from the list of ciphers/ciphersuites to the "PROFILE=SYSTEM"
> string; although I have no idea what will this do with the expectations
> within the test suite…
>
> Hope this helps somehow!

From dbeveniu:
> Hi,
>
> I'm not familiar with Fedora's crypto policies, but from what I've read the usage of SSL_CTX_set_cipher_list is used in Node when a cipher list is specified as an argument to createSecureContext.
> There is also a the default cipher list which can be configured using an option to node, for example:
> $ node --tls-cipher-list='PROFILE=SYSTEM' -p "require('crypto').constants.defaultCipherList;"
> PROFILE=SYSTEM
> or as an environment variable
> $ env NODE_OPTIONS=--tls-cipher-list='PROFILE_SYSTEM' ./node -p "require('crypto').constants.defaultCipherList;"
> PROFILE=SYSTEM
>
> It is also possible to set --openssl-config to point to a openssl.cnf configuration, or use the environment variable OPENSSL_CONF if it needs to be explicitly configured.
>
> If those options don't help perhaps we could consider a build time configuration option where the defaults can be specified. For example:
> ./configure --openssl-default-cipher-list="PROFILE_SYSTEM"
>
> With that said it sounds like rpmlint would complain just the same because of the usage of SSL_CTX_set_cipher.
>
> Regards,
>
> /Dan

From vondruch:
> Thx. Interesting, a lot of options. The only problem is that all of these are runtime options if I understand it correctly.
>
> > If those options don't help perhaps we could consider a build time configuration option where the defaults can be specified. For example:
> > ./configure --openssl-default-cipher-list="PROFILE_SYSTEM"
>
> Configure option would be really nice. Otherwise, we need to apply downstream patch which is also reasonable. This is one example of the package where we do this:
>
> https://src.fedoraproject.org/rpms/rubygem-puma/blob/master/f/rubygem-puma.spec#_26
>
> > With that said it sounds like rpmlint would complain just the same because of the usage of SSL_CTX_set_cipher.
>
> Right, but the warning already did its job, if we are discussing this issue. After we fix this, there will be the ticket tracking the issue + some explanatory comment in .spec file + commit message. So it should be easy to discover the warning is false positive. Actually it should be possible to suppress the warning via rpmlint dot file included in the repository if I am not mistaken.
>
> Vít

From dbeveniu:
> >Configure option would be really nice.
> Great, I'll take a look at adding this and I'll post back a link to the PR once created.

From dbeveniu:
> I've created a suggestion for this option:
> https://github.com/nodejs/node/pull/33708
>
> There might be pushback on adding this if it is viewed as we are only doing it for Fedora/RHEL. Do you know if any other distributions do anything like this?
>
> Thanks,
>
> /Dan

From vondruch:
> Hi Nikos,
>
> Because you are original author of the Fedora Crypto Policies [1], do you have answer, if any other distros are doing something similar? Ideally, you could share them in the Dan's PR of if you know somebody from other distros, who could support it.
>
> Vít
>
> [1] https://fedoraproject.org/wiki/Changes/CryptoPolicy

From nmav:
> Hi Vit,
>  (adding rhel-crypto as well). I know that debian tries to do
> something similar and ships a crypto-policies package:
>
> https://wiki.debian.org/CryptoPolicy
> https://packages.debian.org/sid/crypto-policies
>
> Other than that I do not know, maybe Tomas has a better view.
>
> regards,
> Nikos

From tmraz:
> In my opinion the suggested upstream PR should be uncontroversial as it
> might be very much useful also in other contexts just than on Fedora
> with its crypto-policies. The package maintainer building the NodeJS
> package on any distro or even in out-of-distro context might have very
> different needs and preferences for the default cipher list
> configuration than the thing that is hardcoded in the NodeJS sources. I
> am not saying the hardcoded default is particularly wrong but it is
> somewhat strange and there might be different needs in different
> contexts.
>
> As for adoption of crypto-policies outside of Fedora/RHEL, I do not
> have anything more than what Nikos already said below.

As the PR proposed in the original ML thread was merged upstream in version 15.0.0, I will prepare a downstream patch backporting this option to our currently supported releases.

The proposed change was included in upstream releases v14.5.0 and v12.18.3. It should be enough to use `./configure --openssl-default-cipher-list=PROFILE=SYSTEM` while building the RPMs.

I will prepare the relevant PRs.

This change seems to be commited to dist-git via http://pkgs.devel.redhat.com/cgit/rpms/nodejs/commit/?h=stream-14&id=8ca81b5fbdcd56c559f03bd55361b470f39f3645