FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

crypto: migrate setFipsCrypto to internal/errors · nodejs/node@ee76f31 · GitHub

/ node Public

Commit ee76f31

Browse files
jasnell
committed
crypto: migrate setFipsCrypto to internal/errors
With the exception of ThrowCryptoError, use internal/errors to report fips unavailable or forced PR-URL: #16428 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
1 parent a0f7ae6 commit ee76f31

6 files changed

Lines changed: 65 additions & 19 deletions

File tree

‎doc/api/errors.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -643,6 +643,17 @@ Used when an invalid value for the `format` argument has been passed to the
643643
Used when an invalid crypto engine identifier is passed to
644644
[`require('crypto').setEngine()`][].
645645

646+
<a id="ERR_CRYPTO_FIPS_FORCED"></a>
647+
### ERR_CRYPTO_FIPS_FORCED
648+
649+
Used when trying to enable or disable FIPS mode in the crypto module and
650+
the [`--force-fips`][] command-line argument is used.
651+
652+
<a id="ERR_CRYPTO_FIPS_UNAVAILABLE"></a>
653+
### ERR_CRYPTO_FIPS_UNAVAILABLE
654+
655+
Used when trying to enable or disable FIPS mode when FIPS is not available.
656+
646657
<a id="ERR_CRYPTO_HASH_DIGEST_NO_UTF16"></a>
647658
### ERR_CRYPTO_HASH_DIGEST_NO_UTF16
648659

@@ -1440,6 +1451,7 @@ Used when a given value is out of the accepted range.
14401451
Used when an attempt is made to use a `zlib` object after it has already been
14411452
closed.
14421453

1454+
[`--force-fips`]: cli.html#cli_force_fips
14431455
[`crypto.timingSafeEqual()`]: crypto.html#crypto_crypto_timingsafeequal_a_b
14441456
[`dgram.createSocket()`]: dgram.html#dgram_dgram_createsocket_options_callback
14451457
[`ERR_INVALID_ARG_TYPE`]: #ERR_INVALID_ARG_TYPE

‎lib/crypto.js‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,12 @@ const {
3030
} = require('internal/util');
3131
assertCrypto();
3232

33+
const errors = require('internal/errors');
3334
const constants = process.binding('constants').crypto;
35+
const {
36+
fipsMode,
37+
fipsForced
38+
} = process.binding('config');
3439
const {
3540
getFipsCrypto,
3641
setFipsCrypto,
@@ -173,10 +178,29 @@ module.exports = exports = {
173178
Verify
174179
};
175180

181+
function setFipsDisabled() {
182+
throw new errors.Error('ERR_CRYPTO_FIPS_UNAVAILABLE');
183+
}
184+
185+
function setFipsForced(val) {
186+
if (val) return;
187+
throw new errors.Error('ERR_CRYPTO_FIPS_FORCED');
188+
}
189+
190+
function getFipsDisabled() {
191+
return 0;
192+
}
193+
194+
function getFipsForced() {
195+
return 1;
196+
}
197+
176198
Object.defineProperties(exports, {
177199
fips: {
178-
get: getFipsCrypto,
179-
set: setFipsCrypto
200+
get: !fipsMode ? getFipsDisabled :
201+
fipsForced ? getFipsForced : getFipsCrypto,
202+
set: !fipsMode ? setFipsDisabled :
203+
fipsForced ? setFipsForced : setFipsCrypto
180204
},
181205
DEFAULT_ENCODING: {
182206
enumerable: true,

‎lib/internal/errors.js‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,9 @@ E('ERR_CONSOLE_WRITABLE_STREAM',
156156
E('ERR_CPU_USAGE', 'Unable to obtain cpu usage %s');
157157
E('ERR_CRYPTO_ECDH_INVALID_FORMAT', 'Invalid ECDH format: %s');
158158
E('ERR_CRYPTO_ENGINE_UNKNOWN', 'Engine "%s" was not found');
159+
E('ERR_CRYPTO_FIPS_FORCED',
160+
'Cannot set FIPS mode, it was forced with --force-fips at startup.');
161+
E('ERR_CRYPTO_FIPS_UNAVAILABLE', 'Cannot set FIPS mode in a non-FIPS build.');
159162
E('ERR_CRYPTO_HASH_DIGEST_NO_UTF16', 'hash.digest() does not support UTF-16');
160163
E('ERR_CRYPTO_HASH_FINALIZED', 'Digest already called');
161164
E('ERR_CRYPTO_HASH_UPDATE_FAILED', 'Hash update failed');

‎src/node_config.cc‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,12 @@ static void InitConfig(Local<Object> target,
4444
Environment* env = Environment::GetCurrent(context);
4545
Isolate* isolate = env->isolate();
4646

47+
#ifdef NODE_FIPS_MODE
48+
READONLY_BOOLEAN_PROPERTY("fipsMode");
49+
if (force_fips_crypto)
50+
READONLY_BOOLEAN_PROPERTY("fipsForced");
51+
#endif
52+
4753
#ifdef NODE_HAVE_I18N_SUPPORT
4854

4955
READONLY_BOOLEAN_PROPERTY("hasIntl");

‎src/node_crypto.cc‎

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5946,32 +5946,24 @@ void SetEngine(const FunctionCallbackInfo<Value>& args) {
59465946
}
59475947
#endif // !OPENSSL_NO_ENGINE
59485948

5949+
#ifdef NODE_FIPS_MODE
59495950
void GetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
5950-
if (FIPS_mode()) {
5951-
args.GetReturnValue().Set(1);
5952-
} else {
5953-
args.GetReturnValue().Set(0);
5954-
}
5951+
args.GetReturnValue().Set(FIPS_mode() ? 1 : 0);
59555952
}
59565953

59575954
void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
5955+
CHECK(!force_fips_crypto);
59585956
Environment* env = Environment::GetCurrent(args);
5959-
#ifdef NODE_FIPS_MODE
59605957
const bool enabled = FIPS_mode();
59615958
const bool enable = args[0]->BooleanValue();
59625959
if (enable == enabled)
59635960
return; // No action needed.
5964-
if (force_fips_crypto) {
5965-
return env->ThrowError(
5966-
"Cannot set FIPS mode, it was forced with --force-fips at startup.");
5967-
} else if (!FIPS_mode_set(enable)) {
5961+
if (!FIPS_mode_set(enable)) {
59685962
unsigned long err = ERR_get_error(); // NOLINT(runtime/int)
59695963
return ThrowCryptoError(env, err);
59705964
}
5971-
#else
5972-
return env->ThrowError("Cannot set FIPS mode in a non-FIPS build.");
5973-
#endif /* NODE_FIPS_MODE */
59745965
}
5966+
#endif /* NODE_FIPS_MODE */
59755967

59765968
void InitCrypto(Local<Object> target,
59775969
Local<Value> unused,
@@ -5997,8 +5989,12 @@ void InitCrypto(Local<Object> target,
59975989
#ifndef OPENSSL_NO_ENGINE
59985990
env->SetMethod(target, "setEngine", SetEngine);
59995991
#endif // !OPENSSL_NO_ENGINE
5992+
5993+
#ifdef NODE_FIPS_MODE
60005994
env->SetMethod(target, "getFipsCrypto", GetFipsCrypto);
60015995
env->SetMethod(target, "setFipsCrypto", SetFipsCrypto);
5996+
#endif
5997+
60025998
env->SetMethod(target, "PBKDF2", PBKDF2);
60035999
env->SetMethod(target, "randomBytes", RandomBytes);
60046000
env->SetMethod(target, "randomFill", RandomBytesBuffer);

‎test/parallel/test-crypto-fips.js‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,12 @@ const fixtures = require('../common/fixtures');
1010

1111
const FIPS_ENABLED = 1;
1212
const FIPS_DISABLED = 0;
13-
const FIPS_ERROR_STRING = 'Error: Cannot set FIPS mode';
13+
const FIPS_ERROR_STRING =
14+
'Error [ERR_CRYPTO_FIPS_UNAVAILABLE]: Cannot set FIPS mode in a ' +
15+
'non-FIPS build.';
16+
const FIPS_ERROR_STRING2 =
17+
'Error [ERR_CRYPTO_FIPS_FORCED]: Cannot set FIPS mode, it was forced with ' +
18+
'--force-fips at startup.';
1419
const OPTION_ERROR_STRING = 'bad option';
1520

1621
const CNF_FIPS_ON = fixtures.path('openssl_fips_enabled.cnf');
@@ -208,7 +213,7 @@ testHelper(
208213
testHelper(
209214
'stderr',
210215
['--force-fips'],
211-
compiledWithFips() ? FIPS_ERROR_STRING : OPTION_ERROR_STRING,
216+
compiledWithFips() ? FIPS_ERROR_STRING2 : OPTION_ERROR_STRING,
212217
'require("crypto").fips = false',
213218
process.env);
214219

@@ -225,14 +230,14 @@ testHelper(
225230
testHelper(
226231
'stderr',
227232
['--force-fips', '--enable-fips'],
228-
compiledWithFips() ? FIPS_ERROR_STRING : OPTION_ERROR_STRING,
233+
compiledWithFips() ? FIPS_ERROR_STRING2 : OPTION_ERROR_STRING,
229234
'require("crypto").fips = false',
230235
process.env);
231236

232237
//--enable-fips and --force-fips order does not matter
233238
testHelper(
234239
'stderr',
235240
['--enable-fips', '--force-fips'],
236-
compiledWithFips() ? FIPS_ERROR_STRING : OPTION_ERROR_STRING,
241+
compiledWithFips() ? FIPS_ERROR_STRING2 : OPTION_ERROR_STRING,
237242
'require("crypto").fips = false',
238243
process.env);

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL