3 ms·

Also from the node.js code, four lines up: 'defines': [ # No clue what these are for. 'L_ENDIAN', 'PURIFY', '_REENTRANT', Lovely. According

by 0x0 13y ago

Also from the node.js code, four lines up: 'defines': [ # No clue what these are for. 'L_ENDIAN', 'PURIFY', '_REENTRANT', Lovely. According to https://www.openssl.org/support/faq.html https://www.openssl.org/support/faq.html, PURIFY is used to "get rid off the warnings" when using Valgrind. That sounds remarkably similar to the original Debian PRNG openssl bug (wasn't non-PURIFY code deleted just to "get rid off some warnings" with Valgrind? - http://research.swtch.com/openssl http://research.swtch.com/openssl)

piscisaureus 13y ago
Node statically links OpenSSL and uses gyp (the chromium build system) to build it. Initially we used the chromium project OpenSSL fork which had these flags set [1]; when we moved to maintain our own gyp-ified fork we kept these flags [2], under the assumption that the chromium folks would know what they're doing. You may argue that this is naive and you may be right. However, just looking at that FAQ, OpenSSL provides a justification why it is safe to ignore the specific valgrind error that -DPURIFY surpresses, so I currently see no reason to change it. When OpenSSL's PRNG routines are called to generate random numbers the supplied buffer contents are mixed into the entropy pool: so it technically does not matter whether the buffer is initialized at this point or not. Valgrind (and other test tools) will complain about this. When using Valgrind, make sure the OpenSSL library has been compiled with the PURIFY macro defined (-DPURIFY) to get rid of these warnings. [1] https://github.com/joyent/node/blob/e80cac622569dda0f6753b452ba3e5085a9d09e5/deps/openssl/openssl.gyp#L18 https://github.com/joyent/node/blob/e80cac622569dda0f6753b45... [2] https://github.com/joyent/node/commit/7eaea7f9e501db0072455fe5c05af261dc7e3204#diff-c37979bc7383677eefcd526f4693de15R16 https://github.com/joyent/node/commit/7eaea7f9e501db0072455f... Edit: fixed link
- computer 13y ago
  Does PURIFY get rid of the warnings by suppressing them, or by disabling code temporarily for debugging purposes (since it mentions macros)? The FAQ seems unclear on that point.
  - ibmthrowaway218 13y ago
    You can see the code affected by the PURIFY define here:- https://github.com/joyent/node/search?q=PURIFY https://github.com/joyent/node/search?q=PURIFY Specifically it is these two files:- https://github.com/joyent/node/blob/5fcd6e40385f45bc9091689337a7ab531861ba19/deps/openssl/openssl/crypto/rand/randfile.c https://github.com/joyent/node/blob/5fcd6e40385f45bc90916893... https://github.com/joyent/node/blob/c20b209dbb7e2f3ac8a75a8750bc4205d43952c8/deps/openssl/openssl/crypto/rand/md_rand.c https://github.com/joyent/node/blob/c20b209dbb7e2f3ac8a75a87... In the first it just does a memset of the buffer so that the values are not unset. In the second it doesn't use a (possibly only partially filled) buffer as a source of entropy.

by 0x0 13y ago

piscisaureus 13y ago

Node statically links OpenSSL and uses gyp (the chromium build system) to build it. Initially we used the chromium project OpenSSL fork which had these flags set [1]; when we moved to maintain our own gyp-ified fork we kept these flags [2], under the assumption that the chromium folks would know what they're doing. You may argue that this is naive and you may be right. However, just looking at that FAQ, OpenSSL provides a justification why it is safe to ignore the specific valgrind error that -DPURIFY surpresses, so I currently see no reason to change it. When OpenSSL's PRNG routines are called to generate random numbers the supplied buffer contents are mixed into the entropy pool: so it technically does not matter whether the buffer is initialized at this point or not. Valgrind (and other test tools) will complain about this. When using Valgrind, make sure the OpenSSL library has been compiled with the PURIFY macro defined (-DPURIFY) to get rid of these warnings. [1] https://github.com/joyent/node/blob/e80cac622569dda0f6753b452ba3e5085a9d09e5/deps/openssl/openssl.gyp#L18 https://github.com/joyent/node/blob/e80cac622569dda0f6753b45... [2] https://github.com/joyent/node/commit/7eaea7f9e501db0072455fe5c05af261dc7e3204#diff-c37979bc7383677eefcd526f4693de15R16 https://github.com/joyent/node/commit/7eaea7f9e501db0072455f... Edit: fixed link

computer 13y ago
Does PURIFY get rid of the warnings by suppressing them, or by disabling code temporarily for debugging purposes (since it mentions macros)? The FAQ seems unclear on that point.
- ibmthrowaway218 13y ago
  You can see the code affected by the PURIFY define here:- https://github.com/joyent/node/search?q=PURIFY https://github.com/joyent/node/search?q=PURIFY Specifically it is these two files:- https://github.com/joyent/node/blob/5fcd6e40385f45bc9091689337a7ab531861ba19/deps/openssl/openssl/crypto/rand/randfile.c https://github.com/joyent/node/blob/5fcd6e40385f45bc90916893... https://github.com/joyent/node/blob/c20b209dbb7e2f3ac8a75a8750bc4205d43952c8/deps/openssl/openssl/crypto/rand/md_rand.c https://github.com/joyent/node/blob/c20b209dbb7e2f3ac8a75a87... In the first it just does a memset of the buffer so that the values are not unset. In the second it doesn't use a (possibly only partially filled) buffer as a source of entropy.