src: add --openssl-legacy-provider option

[danbev]

This commit adds an option to Node.js named --openssl-legacy-provider and
if specified will load OpenSSL 3.0 Legacy provider.

$ ./node --help
...
--openssl-legacy-provider  enable OpenSSL 3.0 legacy provider

Example usage:

$ ./node --openssl-legacy-provider  -p 'crypto.createHash("md4")'
Hash {
  _options: undefined,
  [Symbol(kHandle)]: Hash {},
  [Symbol(kState)]: { [Symbol(kFinalized)]: false }
}

Co-authored-by: Richard Lau [email protected]

Refs: #40455

---

This is an alternative to the suggestion in #40466

[tniessen]

Neither this PR nor #40466 load the legacy provider by default, and I think that makes sense. While these PRs make the legacy provider available, this will not unbreak npm.

[richardlau]

Neither this PR nor #40466 load the legacy provider by default, and I think that makes sense. While these PRs make the legacy provider available, this will not unbreak npm.

I agree about not being the default making sense -- this option should be intended to be used as a stop-gap until dependencies can be updated to migrate away from the weaker crypto algorithms.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/40327/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/40328/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/40341/

[danbev]

@tniessen @targos @RaisinTen @BethGriggs @mhdawson I would be great if we could get this PR merged today and into the Node.js 17 release tomorrow. Would one or more of you be able to review?

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/40343/

[simllll]

Should this work now with node16?

# node --version 
v16.17.0

# node --openssl-legacy-provider
node: bad option: --openssl-legacy-provider

In our use case it woudl be enough if it just doesn't fail with an error message, as we need this flag for all our devs that are on node 16+, but we can't add it for all that are still on node 16

[mshabarov]

I also have the same issue with v16.17.0:

# node -v   
v16.17.0
# node --openssl-legacy-provider
node: bad option: --openssl-legacy-provider

node --help doesn't show this parameter in the list.

[BethGriggs]

@mshabarov what is your output of $ node -p process.versions.openssl? I believe the option is only relevant (and therefore available) when using OpenSSL 3.0 (refs). Node.js 16 ships with OpenSSL 1.1.1 by default.

[mshabarov]

@BethGriggs my output is 1.1.1q+quic, thanks!