[7.17] [node] Enable openssl legacy provider (#165147)

Backports #163190

Co-authored-by: Thomas Watson <w@tson.dk>

config/node.options

@@ -10,3 +10,6 @@
 
 ## restore < Node 16 default DNS lookup behavior
 --dns-result-order=ipv4first
+
+## enable OpenSSL 3 legacy provider
+--openssl-legacy-provider

docs/user/production-considerations/production.asciidoc

@@ -109,3 +109,12 @@ The option accepts a limit in MB:
 --------
 --max-old-space-size=2048
 --------
+
+[float]
+[[openssl-legacy-provider]]
+=== OpenSSL Legacy Provider
+
+Starting in 7.17.13, {kib} has upgraded its runtime environment, Node.js, from version 16 to version 18 and with it the underlying version of OpenSSL to version 3.
+Algorithms deemed legacy by OpenSSL 3 have been re-enabled to avoid potential breaking changes in a minor version release of {kib}.
+If SSL certificates configured for {kib} are not using any of the legacy algorithms mentioned in the https://www.openssl.org/docs/man3.0/man7/OSSL_PROVIDER-legacy.html[OpenSSL legacy provider documentation],
+we recommend disabling this setting by removing `--openssl-legacy-provider` in the `node.options` config file.

packages/kbn-plugin-helpers/src/integration_tests/build.test.ts

@@ -54,7 +54,8 @@ it('builds a generated plugin into a viable archive', async () => {
   };
 
   expect(filterLogs(generateProc.all)).toMatchInlineSnapshot(`
-    " succ 🎉
+    "Kibana is currently running with legacy OpenSSL providers enabled! For details and instructions on how to disable see https://www.elastic.co/guide/en/kibana/7.17/production.html#openssl-legacy-provider
+     succ 🎉
 
           Your plugin has been created in plugins/foo_test_plugin
     "
@@ -73,7 +74,8 @@ it('builds a generated plugin into a viable archive', async () => {
   );
 
   expect(filterLogs(buildProc.all)).toMatchInlineSnapshot(`
-    " info deleting the build and target directories
+    "Kibana is currently running with legacy OpenSSL providers enabled! For details and instructions on how to disable see https://www.elastic.co/guide/en/kibana/7.17/production.html#openssl-legacy-provider
+     info deleting the build and target directories
      info running @kbn/optimizer
      │ info initialized, 0 bundles cached
      │ info starting worker [1 bundle]

src/dev/build/tasks/os_packages/docker_generator/templates/base/Dockerfile

@@ -119,6 +119,9 @@ ENV PATH=/usr/share/kibana/bin:$PATH
 
 # Set some Kibana configuration defaults.
 COPY --chown=1000:0 config/kibana.yml /usr/share/kibana/config/kibana.yml
+{{^opensslLegacyProvider}}
+RUN sed 's/\(--openssl-legacy-provider\)/#\1/' -i config/node.options
+{{/opensslLegacyProvider}}
 
 # Add the launcher/wrapper script. It knows how to interpret environment
 # variables and translate them to Kibana CLI options.

src/dev/build/tasks/os_packages/docker_generator/templates/dockerfile.template.ts

@@ -17,6 +17,7 @@ function generator(options: TemplateContext) {
   const template = readFileSync(resolve(__dirname, dir, './Dockerfile'));
   return Mustache.render(template.toString(), {
     packageManager: options.ubi ? 'microdnf' : 'apt-get',
+    opensslLegacyProvider: !options.cloud,
     ...options,
   });
 }

src/setup_node_env/no_transpilation_dist.js

@@ -14,3 +14,4 @@ require('./harden');
 require('symbol-observable');
 require('source-map-support/register');
 require('./node_version_validator');
+require('./openssl_legacy_provider');

src/setup_node_env/openssl_legacy_provider/index.js

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+var branch = require('../../../package.json').branch;
+var docsBranch = branch.match(/^\d\.\d\d?$/) || 'current';
+var openSSLLegacyProviderEnabled = require('./openssl_legacy_provider_enabled')();
+
+if (openSSLLegacyProviderEnabled) {
+  console.log(
+    'Kibana is currently running with legacy OpenSSL providers enabled! For details and instructions on how to disable see https://www.elastic.co/guide/en/kibana/' +
+      docsBranch +
+      '/production.html#openssl-legacy-provider'
+  );
+}

src/setup_node_env/openssl_legacy_provider/openssl_legacy_provider_enabled.js

@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+var crypto = require('crypto');
+
+// The blowfish cipher is only available when node is running with the --openssl-legacy-provider flag
+module.exports = function () {
+  return crypto.getCiphers().includes('blowfish');
+};

src/setup_node_env/openssl_legacy_provider/openssl_legacy_provider_enabled.test.js

@@ -0,0 +1,78 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+var spawnSync = require('child_process').spawnSync;
+
+describe('openSSLLegacyProviderEnabled', function () {
+  function runLegacyProviderCheck(execOptions, nodeOptions) {
+    var result = spawnSync(
+      process.execPath,
+      (execOptions ? execOptions.split(' ') : []).concat([
+        '-p',
+        "require('./openssl_legacy_provider_enabled')()",
+      ]),
+      {
+        env: {
+          NODE_OPTIONS: nodeOptions || '',
+        },
+        encoding: 'utf-8',
+        cwd: __dirname,
+      }
+    );
+    var stdout = result.stdout.trim();
+    return stdout === 'true';
+  }
+
+  it('should be disabled by default', function () {
+    expect(runLegacyProviderCheck()).toBe(false);
+  });
+
+  describe('using NODE_OPTIONS', function () {
+    it('should be enabled when --openssl-legacy-provider is set', function () {
+      expect(runLegacyProviderCheck(null, '--openssl-legacy-provider')).toBe(true);
+    });
+
+    it('should be enabled when --openssl-legacy-provider is set after --no-openssl-legacy-provider', function () {
+      expect(
+        runLegacyProviderCheck(null, '--no-openssl-legacy-provider --openssl-legacy-provider')
+      ).toBe(true);
+    });
+
+    it('should be disabled when --no-openssl-legacy-provider is set', function () {
+      expect(runLegacyProviderCheck(null, '--no-openssl-legacy-provider')).toBe(false);
+    });
+
+    it('should be disabled when --no-openssl-legacy-provider is set after --openssl-legacy-provider', function () {
+      expect(
+        runLegacyProviderCheck(null, '--openssl-legacy-provider --no-openssl-legacy-provider')
+      ).toBe(false);
+    });
+  });
+
+  describe('using exec arguments', function () {
+    it('should be enabled when --openssl-legacy-provider is set', function () {
+      expect(runLegacyProviderCheck('--openssl-legacy-provider')).toBe(true);
+    });
+
+    it('should be enabled when --openssl-legacy-provider is set after --no-openssl-legacy-provider', function () {
+      expect(runLegacyProviderCheck('--no-openssl-legacy-provider --openssl-legacy-provider')).toBe(
+        true
+      );
+    });
+
+    it('should be disabled when --no-openssl-legacy-provider is set', function () {
+      expect(runLegacyProviderCheck('--no-openssl-legacy-provider')).toBe(false);
+    });
+
+    it('should be disabled when --no-openssl-legacy-provider is set after --openssl-legacy-provider', function () {
+      expect(runLegacyProviderCheck('--openssl-legacy-provider --no-openssl-legacy-provider')).toBe(
+        false
+      );
+    });
+  });
+});