From 71e4285e27ad1b53ad556b2260b7f39d53a91663 Mon Sep 17 00:00:00 2001 From: Rod Vagg Date: Tue, 27 Sep 2016 22:33:58 +1000 Subject: [PATCH] crypto: don't build hardware engines Compile out hardware engines. Most are stubs that dynamically load the real driver but that poses a security liability when an attacker is able to create a malicious DLL in one of the default search paths. Backport of https://github.com/nodejs/node-private/pull/58 PR-URL: https://github.com/nodejs/node-private/pull/69 Reviewed-By: Ben Noordhuis Reviewed-By: Fedor Indutny --- deps/openssl/openssl.gyp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/deps/openssl/openssl.gyp b/deps/openssl/openssl.gyp index 58feb474453bb8..462111d53226e0 100644 --- a/deps/openssl/openssl.gyp +++ b/deps/openssl/openssl.gyp @@ -1099,6 +1099,11 @@ # Microsoft's IIS, which seems to be ignoring whole ClientHello after # seeing this extension. 'OPENSSL_NO_HEARTBEATS', + + # Compile out hardware engines. Most are stubs that dynamically load + # the real driver but that poses a security liability when an attacker + # is able to create a malicious DLL in one of the default search paths. + 'OPENSSL_NO_HW', ], 'direct_dependent_settings': { 'defines': [