Commit cfc9764
crypto: fix native module compilation with FIPS
Prevent OpenSSL's fipsld from being used to link native modules
because this requires the original OpenSSL source to be
available after Node's installation.
Fixes: #3815
PR-URL: #4023
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>1 parent e8e4e07 commit cfc9764
4 files changed
Lines changed: 17 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -44,6 +44,7 @@ ipch/ | |||
| 44 | 44 | ||
| 45 | 45 | /config.mk | |
| 46 | 46 | /config.gypi | |
| 47 | + /config_fips.gypi | ||
| 47 | 48 | *-nodegyp* | |
| 48 | 49 | /gyp-mac-tool | |
| 49 | 50 | /dist-osx | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -74,7 +74,7 @@ clean: | |||
| 74 | 74 | ||
| 75 | 75 | distclean: | |
| 76 | 76 | -rm -rf out | |
| 77 | - -rm -f config.gypi icu_config.gypi | ||
| 77 | + -rm -f config.gypi icu_config.gypi config_fips.gypi | ||
| 78 | 78 | -rm -f config.mk | |
| 79 | 79 | -rm -rf $(NODE_EXE) $(NODE_G_EXE) | |
| 80 | 80 | -rm -rf node_modules | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -804,7 +804,7 @@ def configure_openssl(o): | |||
| 804 | 804 | o['variables']['openssl_fips'] = options.openssl_fips | |
| 805 | 805 | fips_dir = os.path.join(root_dir, 'deps', 'openssl', 'fips') | |
| 806 | 806 | fips_ld = os.path.abspath(os.path.join(fips_dir, 'fipsld')) | |
| 807 | - o['make_global_settings'] = [ | ||
| 807 | + o['make_fips_settings'] = [ | ||
| 808 | 808 | ['LINK', fips_ld + ' <(openssl_fips)/bin/fipsld'], | |
| 809 | 809 | ] | |
| 810 | 810 | else: | |
@@ -1126,6 +1126,15 @@ configure_fullystatic(output) | |||
| 1126 | 1126 | variables = output['variables'] | |
| 1127 | 1127 | del output['variables'] | |
| 1128 | 1128 | ||
| 1129 | + # make_global_settings for special FIPS linking | ||
| 1130 | + # should not be used to compile modules in node-gyp | ||
| 1131 | + config_fips = { 'make_global_settings' : [] } | ||
| 1132 | + if 'make_fips_settings' in output: | ||
| 1133 | + config_fips['make_global_settings'] = output['make_fips_settings'] | ||
| 1134 | + del output['make_fips_settings'] | ||
| 1135 | + write('config_fips.gypi', do_not_edit + | ||
| 1136 | + pprint.pformat(config_fips, indent=2) + '\n') | ||
| 1137 | + | ||
| 1129 | 1138 | # make_global_settings should be a root level element too | |
| 1130 | 1139 | if 'make_global_settings' in output: | |
| 1131 | 1140 | make_global_settings = output['make_global_settings'] | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -30,17 +30,22 @@ def run_gyp(args): | |||
| 30 | 30 | args.append(os.path.join(node_root, 'node.gyp')) | |
| 31 | 31 | common_fn = os.path.join(node_root, 'common.gypi') | |
| 32 | 32 | options_fn = os.path.join(node_root, 'config.gypi') | |
| 33 | + options_fips_fn = os.path.join(node_root, 'config_fips.gypi') | ||
| 33 | 34 | else: | |
| 34 | 35 | args.append(os.path.join(os.path.abspath(node_root), 'node.gyp')) | |
| 35 | 36 | common_fn = os.path.join(os.path.abspath(node_root), 'common.gypi') | |
| 36 | 37 | options_fn = os.path.join(os.path.abspath(node_root), 'config.gypi') | |
| 38 | + options_fips_fn = os.path.join(os.path.abspath(node_root), 'config_fips.gypi') | ||
| 37 | 39 | ||
| 38 | 40 | if os.path.exists(common_fn): | |
| 39 | 41 | args.extend(['-I', common_fn]) | |
| 40 | 42 | ||
| 41 | 43 | if os.path.exists(options_fn): | |
| 42 | 44 | args.extend(['-I', options_fn]) | |
| 43 | 45 | ||
| 46 | + if os.path.exists(options_fips_fn): | ||
| 47 | + args.extend(['-I', options_fips_fn]) | ||
| 48 | + | ||
| 44 | 49 | args.append('--depth=' + node_root) | |
| 45 | 50 | ||
| 46 | 51 | # There's a bug with windows which doesn't allow this feature. | |
0 commit comments