src,build: add --openssl-default-cipher-list

[danbev]

This commit adds a configuration option named
openssl-default-cipher-list which takes a colon separated string
specifying ciphers that should be used as the default ciphers instead of
the ones defined in node_constants.

The motivation for this is a use case where Fedora/RHEL would like
to be able to specify a default cipher in the format PROFILE=SYSTEM.
This would enable Fedora/RHEL to have a system wide security level for
all applications.

Refs: https://docs.fedoraproject.org/en-US/packaging-guidelines/CryptoPolicies/

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• commit message follows commit guidelines

[mscdex]

Perhaps it would be a good idea to add a note to the tls documentation to let users know that the default TLS cipher list may not match the hard-coded list shown in the documentation and that they may need to inspect crypto.constants.defaultCoreCipherList and/or crypto.constants.defaultCipherList to determine what ciphers will be used.

I'm kind of surprised we don't already mention these crypto.constants properties in the appropriate section of the tls documentation.

[jasnell]

How does this relate to the existing --tls-cipher-list= command-line argument?

[danbev]

Perhaps it would be a good idea to add a note to the tls documentation

Good point, I'll add something in that document. Thanks

[danbev]

How does this relate to the existing --tls-cipher-list= command-line argument?

Using the command-line option or the NODE_OPTIONS environment variable allows the cipher list to be overridden at runtime. The would be something the a user actively does, whereas being able to set the default cipher list at build time will allow distributions to have their own default list and the users can opt out of if they need to.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/31731/

[danbev]

Re-run of failing node-test-commit-linux-containered/ ✔️
Re-run of failing node-test-commit-osx ✔️

[danbev]

Landed in 7f8e977.

[AdamMajer]

Just a question about setting the default ciphers to PROFILE=SYSTEM. Is node suppose to resolve these ciphers via openssl for crypto.constants.defaultCipherList and crypto.constants.defaultCoreCipherList or will magic constants be retained as PROFILE=SYSTEM and then passed to OpenSSL at a later stage?