FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

crypto: make FIPS related options always available · nodejs/node@0d448ea · GitHub

/ node Public

Commit 0d448ea

Browse files
voxik
authored and
richardlau
committed
crypto: make FIPS related options always available
There is no reason to hide FIPS functionality behind build flags. OpenSSL always provide the information about FIPS availability via `FIPS_mode()` function. This makes the user experience more consistent, because the OpenSSL library is always queried and the `crypto.getFips()` always returns OpenSSL settings. Fixes: #34903 Backport-PR-URL: #40241 PR-URL: #36341 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Michael Dawson <midawson@redhat.com> Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
1 parent 2c36596 commit 0d448ea

11 files changed

Lines changed: 82 additions & 106 deletions

‎doc/api/cli.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -201,8 +201,8 @@ priority than `--dns-result-order`.
201201
added: v6.0.0
202202
-->
203203

204-
Enable FIPS-compliant crypto at startup. (Requires Node.js to be built with
205-
`./configure --openssl-fips`.)
204+
Enable FIPS-compliant crypto at startup. (Requires Node.js to be built
205+
against FIPS-compatible OpenSSL.)
206206

207207
### `--enable-source-maps`
208208
<!-- YAML
@@ -623,8 +623,8 @@ added: v6.9.0
623623
-->
624624

625625
Load an OpenSSL configuration file on startup. Among other uses, this can be
626-
used to enable FIPS-compliant crypto if Node.js is built with
627-
`./configure --openssl-fips`.
626+
used to enable FIPS-compliant crypto if Node.js is built
627+
against FIPS-enabled OpenSSL.
628628

629629
### `--pending-deprecation`
630630
<!-- YAML

‎lib/crypto.js‎

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,10 @@ assertCrypto();
3737

3838
const {
3939
ERR_CRYPTO_FIPS_FORCED,
40-
ERR_CRYPTO_FIPS_UNAVAILABLE
4140
} = require('internal/errors').codes;
4241
const constants = internalBinding('constants').crypto;
4342
const { getOptionValue } = require('internal/options');
4443
const pendingDeprecation = getOptionValue('--pending-deprecation');
45-
const { fipsMode } = internalBinding('config');
4644
const fipsForced = getOptionValue('--force-fips');
4745
const {
4846
getFipsCrypto,
@@ -193,10 +191,8 @@ module.exports = {
193191
sign: signOneShot,
194192
setEngine,
195193
timingSafeEqual,
196-
getFips: !fipsMode ? getFipsDisabled :
197-
fipsForced ? getFipsForced : getFipsCrypto,
198-
setFips: !fipsMode ? setFipsDisabled :
199-
fipsForced ? setFipsForced : setFipsCrypto,
194+
getFips: fipsForced ? getFipsForced : getFipsCrypto,
195+
setFips: fipsForced ? setFipsForced : setFipsCrypto,
200196
verify: verifyOneShot,
201197

202198
// Classes
@@ -215,19 +211,11 @@ module.exports = {
215211
Verify
216212
};
217213

218-
function setFipsDisabled() {
219-
throw new ERR_CRYPTO_FIPS_UNAVAILABLE();
220-
}
221-
222214
function setFipsForced(val) {
223215
if (val) return;
224216
throw new ERR_CRYPTO_FIPS_FORCED();
225217
}
226218

227-
function getFipsDisabled() {
228-
return 0;
229-
}
230-
231219
function getFipsForced() {
232220
return 1;
233221
}
@@ -249,10 +237,8 @@ ObjectDefineProperties(module.exports, {
249237
},
250238
// crypto.fips is deprecated. DEP0093. Use crypto.getFips()/crypto.setFips()
251239
fips: {
252-
get: !fipsMode ? getFipsDisabled :
253-
fipsForced ? getFipsForced : getFipsCrypto,
254-
set: !fipsMode ? setFipsDisabled :
255-
fipsForced ? setFipsForced : setFipsCrypto
240+
get: fipsForced ? getFipsForced : getFipsCrypto,
241+
set: fipsForced ? setFipsForced : setFipsCrypto
256242
},
257243
DEFAULT_ENCODING: {
258244
enumerable: false,

‎node.gypi‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -319,9 +319,6 @@
319319
[ 'node_use_openssl=="true"', {
320320
'defines': [ 'HAVE_OPENSSL=1' ],
321321
'conditions': [
322-
['openssl_fips != "" or openssl_is_fips=="true"', {
323-
'defines': [ 'NODE_FIPS_MODE' ],
324-
}],
325322
[ 'node_shared_openssl=="false"', {
326323
'dependencies': [
327324
'./deps/openssl/openssl.gyp:openssl',

‎src/node.cc‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1040,11 +1040,11 @@ InitializationResult InitializeOncePerProcess(int argc, char** argv) {
10401040
if (credentials::SafeGetenv("NODE_EXTRA_CA_CERTS", &extra_ca_certs))
10411041
crypto::UseExtraCaCerts(extra_ca_certs);
10421042
}
1043-
#ifdef NODE_FIPS_MODE
10441043
// In the case of FIPS builds we should make sure
10451044
// the random source is properly initialized first.
1046-
OPENSSL_init();
1047-
#endif // NODE_FIPS_MODE
1045+
if (FIPS_mode()) {
1046+
OPENSSL_init();
1047+
}
10481048
// V8 on Windows doesn't have a good source of entropy. Seed it from
10491049
// OpenSSL's pool.
10501050
V8::SetEntropySource(crypto::EntropySource);

‎src/node_config.cc‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,7 @@ static void Initialize(Local<Object> target,
4242
READONLY_FALSE_PROPERTY(target, "hasOpenSSL");
4343
#endif // HAVE_OPENSSL
4444

45-
#ifdef NODE_FIPS_MODE
4645
READONLY_TRUE_PROPERTY(target, "fipsMode");
47-
#endif
4846

4947
#ifdef NODE_HAVE_I18N_SUPPORT
5048

‎src/node_crypto.cc‎

Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@
4545
#ifndef OPENSSL_NO_ENGINE
4646
# include <openssl/engine.h>
4747
#endif // !OPENSSL_NO_ENGINE
48+
49+
#ifdef OPENSSL_FIPS
50+
# include <openssl/fips.h>
51+
#endif // OPENSSL_FIPS
52+
4853
#include <openssl/evp.h>
4954
#include <openssl/pem.h>
5055
#include <openssl/x509v3.h>
@@ -98,6 +103,7 @@ using v8::ReadOnly;
98103
using v8::SideEffectType;
99104
using v8::Signature;
100105
using v8::String;
106+
using v8::TryCatch;
101107
using v8::Uint32;
102108
using v8::Uint8Array;
103109
using v8::Undefined;
@@ -183,6 +189,16 @@ static int PasswordCallback(char* buf, int size, int rwflag, void* u) {
183189
return -1;
184190
}
185191

192+
void TestFipsCrypto(const v8::FunctionCallbackInfo<v8::Value>& args) {
193+
#ifdef OPENSSL_FIPS
194+
const auto enabled = FIPS_selftest() ? 1 : 0;
195+
#else // OPENSSL_FIPS
196+
const auto enabled = 0;
197+
#endif // OPENSSL_FIPS
198+
199+
args.GetReturnValue().Set(enabled);
200+
}
201+
186202
// Loads OpenSSL engine by engine id and returns it. The loaded engine
187203
// gets a reference so remember the corresponding call to ENGINE_free.
188204
// In case of error the appropriate js exception is scheduled
@@ -3618,12 +3634,10 @@ void CipherBase::Init(const char* cipher_type,
36183634
HandleScope scope(env()->isolate());
36193635
MarkPopErrorOnReturn mark_pop_error_on_return;
36203636

3621-
#ifdef NODE_FIPS_MODE
36223637
if (FIPS_mode()) {
36233638
return env()->ThrowError(
36243639
"crypto.createCipher() is not supported in FIPS mode.");
36253640
}
3626-
#endif // NODE_FIPS_MODE
36273641

36283642
const EVP_CIPHER* const cipher = EVP_get_cipherbyname(cipher_type);
36293643
if (cipher == nullptr)
@@ -3809,13 +3823,11 @@ bool CipherBase::InitAuthenticated(const char* cipher_type, int iv_len,
38093823
return false;
38103824
}
38113825

3812-
#ifdef NODE_FIPS_MODE
38133826
// TODO(tniessen) Support CCM decryption in FIPS mode
38143827
if (mode == EVP_CIPH_CCM_MODE && kind_ == kDecipher && FIPS_mode()) {
38153828
env()->ThrowError("CCM decryption not supported in FIPS mode");
38163829
return false;
38173830
}
3818-
#endif
38193831

38203832
// Tell OpenSSL about the desired length.
38213833
if (!EVP_CIPHER_CTX_ctrl(ctx_.get(), EVP_CTRL_AEAD_SET_TAG, auth_tag_len,
@@ -4690,7 +4702,6 @@ static AllocatedBuffer Node_SignFinal(Environment* env,
46904702
}
46914703

46924704
static inline bool ValidateDSAParameters(EVP_PKEY* key) {
4693-
#ifdef NODE_FIPS_MODE
46944705
/* Validate DSA2 parameters from FIPS 186-4 */
46954706
if (FIPS_mode() && EVP_PKEY_DSA == EVP_PKEY_base_id(key)) {
46964707
DSA* dsa = EVP_PKEY_get0_DSA(key);
@@ -4706,7 +4717,6 @@ static inline bool ValidateDSAParameters(EVP_PKEY* key) {
47064717
(L == 2048 && N == 256) ||
47074718
(L == 3072 && N == 256);
47084719
}
4709-
#endif // NODE_FIPS_MODE
47104720

47114721
return true;
47124722
}
@@ -6866,7 +6876,6 @@ void InitCryptoOnce() {
68666876
settings = nullptr;
68676877
#endif
68686878

6869-
#ifdef NODE_FIPS_MODE
68706879
/* Override FIPS settings in cnf file, if needed. */
68716880
unsigned long err = 0; // NOLINT(runtime/int)
68726881
if (per_process::cli_options->enable_fips_crypto ||
@@ -6876,12 +6885,10 @@ void InitCryptoOnce() {
68766885
}
68776886
}
68786887
if (0 != err) {
6879-
fprintf(stderr,
6880-
"openssl fips failed: %s\n",
6881-
ERR_error_string(err, nullptr));
6882-
UNREACHABLE();
6888+
auto* isolate = Isolate::GetCurrent();
6889+
auto* env = Environment::GetCurrent(isolate);
6890+
return ThrowCryptoError(env, err);
68836891
}
6884-
#endif // NODE_FIPS_MODE
68856892

68866893

68876894
// Turn off compression. Saves memory and protects against CRIME attacks.
@@ -6927,7 +6934,6 @@ void SetEngine(const FunctionCallbackInfo<Value>& args) {
69276934
}
69286935
#endif // !OPENSSL_NO_ENGINE
69296936

6930-
#ifdef NODE_FIPS_MODE
69316937
void GetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
69326938
args.GetReturnValue().Set(FIPS_mode() ? 1 : 0);
69336939
}
@@ -6945,7 +6951,6 @@ void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
69456951
return ThrowCryptoError(env, err);
69466952
}
69476953
}
6948-
#endif /* NODE_FIPS_MODE */
69496954

69506955
namespace {
69516956
// SecureBuffer uses openssl to allocate a Uint8Array using
@@ -6981,10 +6986,16 @@ void Initialize(Local<Object> target,
69816986
Local<Value> unused,
69826987
Local<Context> context,
69836988
void* priv) {
6989+
Environment* env = Environment::GetCurrent(context);
69846990
static uv_once_t init_once = UV_ONCE_INIT;
6991+
TryCatch try_catch{env->isolate()};
69856992
uv_once(&init_once, InitCryptoOnce);
69866993

6987-
Environment* env = Environment::GetCurrent(context);
6994+
if (try_catch.HasCaught() && !try_catch.HasTerminated()) {
6995+
try_catch.ReThrow();
6996+
return;
6997+
}
6998+
69886999
SecureContext::Initialize(env, target);
69897000
target->Set(env->context(),
69907001
FIXED_ONE_BYTE_STRING(env->isolate(), "KeyObjectHandle"),
@@ -7013,10 +7024,9 @@ void Initialize(Local<Object> target,
70137024
env->SetMethod(target, "setEngine", SetEngine);
70147025
#endif // !OPENSSL_NO_ENGINE
70157026

7016-
#ifdef NODE_FIPS_MODE
70177027
env->SetMethodNoSideEffect(target, "getFipsCrypto", GetFipsCrypto);
70187028
env->SetMethod(target, "setFipsCrypto", SetFipsCrypto);
7019-
#endif
7029+
env->SetMethodNoSideEffect(target, "testFipsCrypto", TestFipsCrypto);
70207030

70217031
env->SetMethod(target, "pbkdf2", PBKDF2);
70227032
env->SetMethod(target, "generateKeyPairRSA", GenerateKeyPairRSA);

‎src/node_options.cc‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -766,7 +766,6 @@ PerProcessOptionsParser::PerProcessOptionsParser(
766766
&PerProcessOptions::ssl_openssl_cert_store);
767767
Implies("--use-openssl-ca", "[ssl_openssl_cert_store]");
768768
ImpliesNot("--use-bundled-ca", "[ssl_openssl_cert_store]");
769-
#if NODE_FIPS_MODE
770769
AddOption("--enable-fips",
771770
"enable FIPS crypto at startup",
772771
&PerProcessOptions::enable_fips_crypto,
@@ -775,7 +774,6 @@ PerProcessOptionsParser::PerProcessOptionsParser(
775774
"force FIPS crypto (cannot be disabled)",
776775
&PerProcessOptions::force_fips_crypto,
777776
kAllowedInEnvironment);
778-
#endif
779777
#endif
780778
AddOption("--use-largepages",
781779
"Map the Node.js static code to large pages. Options are "

‎src/node_options.h‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -245,10 +245,8 @@ class PerProcessOptions : public Options {
245245
#endif
246246
bool use_openssl_ca = false;
247247
bool use_bundled_ca = false;
248-
#if NODE_FIPS_MODE
249248
bool enable_fips_crypto = false;
250249
bool force_fips_crypto = false;
251-
#endif
252250
#endif
253251

254252
// Per-process because reports can be triggered outside a known V8 context.

‎test/parallel/test-cli-node-print-help.js‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,6 @@ const common = require('../common');
88

99
const assert = require('assert');
1010
const { exec } = require('child_process');
11-
const { internalBinding } = require('internal/test/binding');
12-
const { fipsMode } = internalBinding('config');
1311
let stdOut;
1412

1513

@@ -28,9 +26,8 @@ function validateNodePrintHelp() {
2826
const cliHelpOptions = [
2927
{ compileConstant: HAVE_OPENSSL,
3028
flags: [ '--openssl-config=...', '--tls-cipher-list=...',
31-
'--use-bundled-ca', '--use-openssl-ca' ] },
32-
{ compileConstant: fipsMode,
33-
flags: [ '--enable-fips', '--force-fips' ] },
29+
'--use-bundled-ca', '--use-openssl-ca',
30+
'--enable-fips', '--force-fips' ] },
3431
{ compileConstant: NODE_HAVE_I18N_SUPPORT,
3532
flags: [ '--icu-data-dir=...', 'NODE_ICU_DATA' ] },
3633
{ compileConstant: HAVE_INSPECTOR,

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL