Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit c67dcc9

Browse filesBrowse files
mhdawsonMylesBorins
authored andcommitted
crypto: don't assume FIPS is disabled by default
For binaries that use --shared-openssl FIPs may be enabled by default by the system. Allow --force-fips and --enable-fips to be specified in these cases. Signed-off-by: Michael Dawson <mdawson@devrus.com> PR-URL: #46532 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
1 parent 9a5a274 commit c67dcc9
Copy full SHA for c67dcc9

File tree

Expand file treeCollapse file tree

2 files changed

+13
-8
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

2 files changed

+13
-8
lines changed
Open diff view settings
Collapse file

‎src/crypto/crypto_util.cc‎

Copy file name to clipboardExpand all lines: src/crypto/crypto_util.cc
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,8 @@ bool ProcessFipsOptions() {
120120
return EVP_default_properties_enable_fips(nullptr, 1) &&
121121
EVP_default_properties_is_fips_enabled(nullptr);
122122
#else
123-
return FIPS_mode() == 0 && FIPS_mode_set(1);
123+
if (FIPS_mode() == 0) return FIPS_mode_set(1);
124+
124125
#endif
125126
}
126127
return true;
Collapse file

‎test/parallel/test-crypto-fips.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-crypto-fips.js
+11-7Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -77,13 +77,17 @@ testHelper(
7777
'process.versions',
7878
process.env);
7979

80-
// By default FIPS should be off in both FIPS and non-FIPS builds.
81-
testHelper(
82-
'stdout',
83-
[],
84-
FIPS_DISABLED,
85-
'require("crypto").getFips()',
86-
{ ...process.env, 'OPENSSL_CONF': ' ' });
80+
// By default FIPS should be off in both FIPS and non-FIPS builds
81+
// unless Node.js was configured using --shared-openssl in
82+
// which case it may be enabled by the system.
83+
if (!sharedOpenSSL()) {
84+
testHelper(
85+
'stdout',
86+
[],
87+
FIPS_DISABLED,
88+
'require("crypto").getFips()',
89+
{ ...process.env, 'OPENSSL_CONF': ' ' });
90+
}
8791

8892
// Toggling fips with setFips should not be allowed from a worker thread
8993
testHelper(

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.