Hacker News Reader

Comment by 0x0 | Hacker News Reader

Also from the node.js code, four lines up:

  'defines': [
    # No clue what these are for.
    'L_ENDIAN',
    'PURIFY',
    '_REENTRANT',

Lovely. According to https://www.openssl.org/support/faq.html, PURIFY is used to "get rid off the warnings" when using Valgrind. That sounds remarkably similar to the original Debian PRNG openssl bug (wasn't non-PURIFY code deleted just to "get rid off some warnings" with Valgrind? - http://research.swtch.com/openssl)

View on HN

Node statically links OpenSSL and uses gyp (the chromium build system) to build it.

Initially we used the chromium project OpenSSL fork which had these flags set [1]; when we moved to maintain our own gyp-ified fork we kept these flags [2], under the assumption that the chromium folks would know what they're doing.

You may argue that this is naive and you may be right.

However, just looking at that FAQ, OpenSSL provides a justification why it is safe to ignore the specific valgrind error that -DPURIFY surpresses, so I currently see no reason to change it.

    When OpenSSL's PRNG routines are called to generate random numbers the   
    supplied buffer contents are mixed into the entropy pool: so it 
    technically does not matter whether the buffer is initialized at this 
    point or not. Valgrind (and other test tools) will complain about this. 
    When using Valgrind, make sure the OpenSSL library has been compiled with 
    the PURIFY macro defined (-DPURIFY) to get rid of these warnings.

[1] https://github.com/joyent/node/blob/e80cac622569dda0f6753b45...

[2] https://github.com/joyent/node/commit/7eaea7f9e501db0072455f...

Edit: fixed link

Does PURIFY get rid of the warnings by suppressing them, or by disabling code temporarily for debugging purposes (since it mentions macros)? The FAQ seems unclear on that point.

You can see the code affected by the PURIFY define here:-

https://github.com/joyent/node/search?q=PURIFY

Specifically it is these two files:-

https://github.com/joyent/node/blob/5fcd6e40385f45bc90916893...

https://github.com/joyent/node/blob/c20b209dbb7e2f3ac8a75a87...

In the first it just does a memset of the buffer so that the values are not unset.

In the second it doesn't use a (possibly only partially filled) buffer as a source of entropy.

Reply on news.ycombinator.com