Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 0d448ea

Browse filesBrowse files
voxikrichardlau
voxik
authored and
richardlau
committed
crypto: make FIPS related options always available
There is no reason to hide FIPS functionality behind build flags. OpenSSL always provide the information about FIPS availability via `FIPS_mode()` function. This makes the user experience more consistent, because the OpenSSL library is always queried and the `crypto.getFips()` always returns OpenSSL settings. Fixes: #34903 Backport-PR-URL: #40241 PR-URL: #36341 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Michael Dawson <midawson@redhat.com> Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
1 parent 2c36596 commit 0d448ea
Copy full SHA for 0d448ea

File tree

Expand file treeCollapse file tree

11 files changed

+82
-106
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

11 files changed

+82
-106
lines changed
Open diff view settings
Collapse file

‎doc/api/cli.md‎

Copy file name to clipboardExpand all lines: doc/api/cli.md
+4-4Lines changed: 4 additions & 4 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -201,8 +201,8 @@ priority than `--dns-result-order`.
201201
added: v6.0.0
202202
-->
203203

204-
Enable FIPS-compliant crypto at startup. (Requires Node.js to be built with
205-
`./configure --openssl-fips`.)
204+
Enable FIPS-compliant crypto at startup. (Requires Node.js to be built
205+
against FIPS-compatible OpenSSL.)
206206

207207
### `--enable-source-maps`
208208
<!-- YAML
@@ -623,8 +623,8 @@ added: v6.9.0
623623
-->
624624

625625
Load an OpenSSL configuration file on startup. Among other uses, this can be
626-
used to enable FIPS-compliant crypto if Node.js is built with
627-
`./configure --openssl-fips`.
626+
used to enable FIPS-compliant crypto if Node.js is built
627+
against FIPS-enabled OpenSSL.
628628

629629
### `--pending-deprecation`
630630
<!-- YAML
Collapse file

‎lib/crypto.js‎

Copy file name to clipboardExpand all lines: lib/crypto.js
+4-18Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,10 @@ assertCrypto();
3737

3838
const {
3939
ERR_CRYPTO_FIPS_FORCED,
40-
ERR_CRYPTO_FIPS_UNAVAILABLE
4140
} = require('internal/errors').codes;
4241
const constants = internalBinding('constants').crypto;
4342
const { getOptionValue } = require('internal/options');
4443
const pendingDeprecation = getOptionValue('--pending-deprecation');
45-
const { fipsMode } = internalBinding('config');
4644
const fipsForced = getOptionValue('--force-fips');
4745
const {
4846
getFipsCrypto,
@@ -193,10 +191,8 @@ module.exports = {
193191
sign: signOneShot,
194192
setEngine,
195193
timingSafeEqual,
196-
getFips: !fipsMode ? getFipsDisabled :
197-
fipsForced ? getFipsForced : getFipsCrypto,
198-
setFips: !fipsMode ? setFipsDisabled :
199-
fipsForced ? setFipsForced : setFipsCrypto,
194+
getFips: fipsForced ? getFipsForced : getFipsCrypto,
195+
setFips: fipsForced ? setFipsForced : setFipsCrypto,
200196
verify: verifyOneShot,
201197

202198
// Classes
@@ -215,19 +211,11 @@ module.exports = {
215211
Verify
216212
};
217213

218-
function setFipsDisabled() {
219-
throw new ERR_CRYPTO_FIPS_UNAVAILABLE();
220-
}
221-
222214
function setFipsForced(val) {
223215
if (val) return;
224216
throw new ERR_CRYPTO_FIPS_FORCED();
225217
}
226218

227-
function getFipsDisabled() {
228-
return 0;
229-
}
230-
231219
function getFipsForced() {
232220
return 1;
233221
}
@@ -249,10 +237,8 @@ ObjectDefineProperties(module.exports, {
249237
},
250238
// crypto.fips is deprecated. DEP0093. Use crypto.getFips()/crypto.setFips()
251239
fips: {
252-
get: !fipsMode ? getFipsDisabled :
253-
fipsForced ? getFipsForced : getFipsCrypto,
254-
set: !fipsMode ? setFipsDisabled :
255-
fipsForced ? setFipsForced : setFipsCrypto
240+
get: fipsForced ? getFipsForced : getFipsCrypto,
241+
set: fipsForced ? setFipsForced : setFipsCrypto
256242
},
257243
DEFAULT_ENCODING: {
258244
enumerable: false,
Collapse file

‎node.gypi‎

Copy file name to clipboardExpand all lines: node.gypi
-3Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -319,9 +319,6 @@
319319
[ 'node_use_openssl=="true"', {
320320
'defines': [ 'HAVE_OPENSSL=1' ],
321321
'conditions': [
322-
['openssl_fips != "" or openssl_is_fips=="true"', {
323-
'defines': [ 'NODE_FIPS_MODE' ],
324-
}],
325322
[ 'node_shared_openssl=="false"', {
326323
'dependencies': [
327324
'./deps/openssl/openssl.gyp:openssl',
Collapse file

‎src/node.cc‎

Copy file name to clipboardExpand all lines: src/node.cc
+3-3Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1040,11 +1040,11 @@ InitializationResult InitializeOncePerProcess(int argc, char** argv) {
10401040
if (credentials::SafeGetenv("NODE_EXTRA_CA_CERTS", &extra_ca_certs))
10411041
crypto::UseExtraCaCerts(extra_ca_certs);
10421042
}
1043-
#ifdef NODE_FIPS_MODE
10441043
// In the case of FIPS builds we should make sure
10451044
// the random source is properly initialized first.
1046-
OPENSSL_init();
1047-
#endif // NODE_FIPS_MODE
1045+
if (FIPS_mode()) {
1046+
OPENSSL_init();
1047+
}
10481048
// V8 on Windows doesn't have a good source of entropy. Seed it from
10491049
// OpenSSL's pool.
10501050
V8::SetEntropySource(crypto::EntropySource);
Collapse file

‎src/node_config.cc‎

Copy file name to clipboardExpand all lines: src/node_config.cc
-2Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,7 @@ static void Initialize(Local<Object> target,
4242
READONLY_FALSE_PROPERTY(target, "hasOpenSSL");
4343
#endif // HAVE_OPENSSL
4444

45-
#ifdef NODE_FIPS_MODE
4645
READONLY_TRUE_PROPERTY(target, "fipsMode");
47-
#endif
4846

4947
#ifdef NODE_HAVE_I18N_SUPPORT
5048

Collapse file

‎src/node_crypto.cc‎

Copy file name to clipboardExpand all lines: src/node_crypto.cc
+27-17Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@
4545
#ifndef OPENSSL_NO_ENGINE
4646
# include <openssl/engine.h>
4747
#endif // !OPENSSL_NO_ENGINE
48+
49+
#ifdef OPENSSL_FIPS
50+
# include <openssl/fips.h>
51+
#endif // OPENSSL_FIPS
52+
4853
#include <openssl/evp.h>
4954
#include <openssl/pem.h>
5055
#include <openssl/x509v3.h>
@@ -98,6 +103,7 @@ using v8::ReadOnly;
98103
using v8::SideEffectType;
99104
using v8::Signature;
100105
using v8::String;
106+
using v8::TryCatch;
101107
using v8::Uint32;
102108
using v8::Uint8Array;
103109
using v8::Undefined;
@@ -183,6 +189,16 @@ static int PasswordCallback(char* buf, int size, int rwflag, void* u) {
183189
return -1;
184190
}
185191

192+
void TestFipsCrypto(const v8::FunctionCallbackInfo<v8::Value>& args) {
193+
#ifdef OPENSSL_FIPS
194+
const auto enabled = FIPS_selftest() ? 1 : 0;
195+
#else // OPENSSL_FIPS
196+
const auto enabled = 0;
197+
#endif // OPENSSL_FIPS
198+
199+
args.GetReturnValue().Set(enabled);
200+
}
201+
186202
// Loads OpenSSL engine by engine id and returns it. The loaded engine
187203
// gets a reference so remember the corresponding call to ENGINE_free.
188204
// In case of error the appropriate js exception is scheduled
@@ -3618,12 +3634,10 @@ void CipherBase::Init(const char* cipher_type,
36183634
HandleScope scope(env()->isolate());
36193635
MarkPopErrorOnReturn mark_pop_error_on_return;
36203636

3621-
#ifdef NODE_FIPS_MODE
36223637
if (FIPS_mode()) {
36233638
return env()->ThrowError(
36243639
"crypto.createCipher() is not supported in FIPS mode.");
36253640
}
3626-
#endif // NODE_FIPS_MODE
36273641

36283642
const EVP_CIPHER* const cipher = EVP_get_cipherbyname(cipher_type);
36293643
if (cipher == nullptr)
@@ -3809,13 +3823,11 @@ bool CipherBase::InitAuthenticated(const char* cipher_type, int iv_len,
38093823
return false;
38103824
}
38113825

3812-
#ifdef NODE_FIPS_MODE
38133826
// TODO(tniessen) Support CCM decryption in FIPS mode
38143827
if (mode == EVP_CIPH_CCM_MODE && kind_ == kDecipher && FIPS_mode()) {
38153828
env()->ThrowError("CCM decryption not supported in FIPS mode");
38163829
return false;
38173830
}
3818-
#endif
38193831

38203832
// Tell OpenSSL about the desired length.
38213833
if (!EVP_CIPHER_CTX_ctrl(ctx_.get(), EVP_CTRL_AEAD_SET_TAG, auth_tag_len,
@@ -4690,7 +4702,6 @@ static AllocatedBuffer Node_SignFinal(Environment* env,
46904702
}
46914703

46924704
static inline bool ValidateDSAParameters(EVP_PKEY* key) {
4693-
#ifdef NODE_FIPS_MODE
46944705
/* Validate DSA2 parameters from FIPS 186-4 */
46954706
if (FIPS_mode() && EVP_PKEY_DSA == EVP_PKEY_base_id(key)) {
46964707
DSA* dsa = EVP_PKEY_get0_DSA(key);
@@ -4706,7 +4717,6 @@ static inline bool ValidateDSAParameters(EVP_PKEY* key) {
47064717
(L == 2048 && N == 256) ||
47074718
(L == 3072 && N == 256);
47084719
}
4709-
#endif // NODE_FIPS_MODE
47104720

47114721
return true;
47124722
}
@@ -6866,7 +6876,6 @@ void InitCryptoOnce() {
68666876
settings = nullptr;
68676877
#endif
68686878

6869-
#ifdef NODE_FIPS_MODE
68706879
/* Override FIPS settings in cnf file, if needed. */
68716880
unsigned long err = 0; // NOLINT(runtime/int)
68726881
if (per_process::cli_options->enable_fips_crypto ||
@@ -6876,12 +6885,10 @@ void InitCryptoOnce() {
68766885
}
68776886
}
68786887
if (0 != err) {
6879-
fprintf(stderr,
6880-
"openssl fips failed: %s\n",
6881-
ERR_error_string(err, nullptr));
6882-
UNREACHABLE();
6888+
auto* isolate = Isolate::GetCurrent();
6889+
auto* env = Environment::GetCurrent(isolate);
6890+
return ThrowCryptoError(env, err);
68836891
}
6884-
#endif // NODE_FIPS_MODE
68856892

68866893

68876894
// Turn off compression. Saves memory and protects against CRIME attacks.
@@ -6927,7 +6934,6 @@ void SetEngine(const FunctionCallbackInfo<Value>& args) {
69276934
}
69286935
#endif // !OPENSSL_NO_ENGINE
69296936

6930-
#ifdef NODE_FIPS_MODE
69316937
void GetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
69326938
args.GetReturnValue().Set(FIPS_mode() ? 1 : 0);
69336939
}
@@ -6945,7 +6951,6 @@ void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
69456951
return ThrowCryptoError(env, err);
69466952
}
69476953
}
6948-
#endif /* NODE_FIPS_MODE */
69496954

69506955
namespace {
69516956
// SecureBuffer uses openssl to allocate a Uint8Array using
@@ -6981,10 +6986,16 @@ void Initialize(Local<Object> target,
69816986
Local<Value> unused,
69826987
Local<Context> context,
69836988
void* priv) {
6989+
Environment* env = Environment::GetCurrent(context);
69846990
static uv_once_t init_once = UV_ONCE_INIT;
6991+
TryCatch try_catch{env->isolate()};
69856992
uv_once(&init_once, InitCryptoOnce);
69866993

6987-
Environment* env = Environment::GetCurrent(context);
6994+
if (try_catch.HasCaught() && !try_catch.HasTerminated()) {
6995+
try_catch.ReThrow();
6996+
return;
6997+
}
6998+
69886999
SecureContext::Initialize(env, target);
69897000
target->Set(env->context(),
69907001
FIXED_ONE_BYTE_STRING(env->isolate(), "KeyObjectHandle"),
@@ -7013,10 +7024,9 @@ void Initialize(Local<Object> target,
70137024
env->SetMethod(target, "setEngine", SetEngine);
70147025
#endif // !OPENSSL_NO_ENGINE
70157026

7016-
#ifdef NODE_FIPS_MODE
70177027
env->SetMethodNoSideEffect(target, "getFipsCrypto", GetFipsCrypto);
70187028
env->SetMethod(target, "setFipsCrypto", SetFipsCrypto);
7019-
#endif
7029+
env->SetMethodNoSideEffect(target, "testFipsCrypto", TestFipsCrypto);
70207030

70217031
env->SetMethod(target, "pbkdf2", PBKDF2);
70227032
env->SetMethod(target, "generateKeyPairRSA", GenerateKeyPairRSA);
Collapse file

‎src/node_options.cc‎

Copy file name to clipboardExpand all lines: src/node_options.cc
-2Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -766,7 +766,6 @@ PerProcessOptionsParser::PerProcessOptionsParser(
766766
&PerProcessOptions::ssl_openssl_cert_store);
767767
Implies("--use-openssl-ca", "[ssl_openssl_cert_store]");
768768
ImpliesNot("--use-bundled-ca", "[ssl_openssl_cert_store]");
769-
#if NODE_FIPS_MODE
770769
AddOption("--enable-fips",
771770
"enable FIPS crypto at startup",
772771
&PerProcessOptions::enable_fips_crypto,
@@ -775,7 +774,6 @@ PerProcessOptionsParser::PerProcessOptionsParser(
775774
"force FIPS crypto (cannot be disabled)",
776775
&PerProcessOptions::force_fips_crypto,
777776
kAllowedInEnvironment);
778-
#endif
779777
#endif
780778
AddOption("--use-largepages",
781779
"Map the Node.js static code to large pages. Options are "
Collapse file

‎src/node_options.h‎

Copy file name to clipboardExpand all lines: src/node_options.h
-2Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -245,10 +245,8 @@ class PerProcessOptions : public Options {
245245
#endif
246246
bool use_openssl_ca = false;
247247
bool use_bundled_ca = false;
248-
#if NODE_FIPS_MODE
249248
bool enable_fips_crypto = false;
250249
bool force_fips_crypto = false;
251-
#endif
252250
#endif
253251

254252
// Per-process because reports can be triggered outside a known V8 context.
Collapse file

‎test/parallel/test-cli-node-print-help.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-cli-node-print-help.js
+2-5Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,6 @@ const common = require('../common');
88

99
const assert = require('assert');
1010
const { exec } = require('child_process');
11-
const { internalBinding } = require('internal/test/binding');
12-
const { fipsMode } = internalBinding('config');
1311
let stdOut;
1412

1513

@@ -28,9 +26,8 @@ function validateNodePrintHelp() {
2826
const cliHelpOptions = [
2927
{ compileConstant: HAVE_OPENSSL,
3028
flags: [ '--openssl-config=...', '--tls-cipher-list=...',
31-
'--use-bundled-ca', '--use-openssl-ca' ] },
32-
{ compileConstant: fipsMode,
33-
flags: [ '--enable-fips', '--force-fips' ] },
29+
'--use-bundled-ca', '--use-openssl-ca',
30+
'--enable-fips', '--force-fips' ] },
3431
{ compileConstant: NODE_HAVE_I18N_SUPPORT,
3532
flags: [ '--icu-data-dir=...', 'NODE_ICU_DATA' ] },
3633
{ compileConstant: HAVE_INSPECTOR,

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.