mirrors/node
0
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-10-28 10:15:07 +08:00
Code Activity

build: remove the bundled FIPS provider build

Browse Source 
--openssl-is-fips with bundled OpenSSL never worked: the
openssl-fipsmodule target had no dependency edge, so fipsinstall's
input was produced by nothing. Repairing it would not help, since a
FIPS provider built out of tree has no validation status.

Remove the machinery and restrict --openssl-is-fips to --shared-openssl.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
This commit is contained in:
Filip Skokan committed 2026-10-25 22:36:35 +01:00
1 parent ee9ae88636
commit 21cfb2a4ad
7 files changed
+33 -167
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

BUILDING.md
+12 -6
View File
@@ -1026,14 +1026,20 @@ using the following configure option:
## Building Node.js with FIPS-compliant OpenSSL
Node.js supports FIPS when statically or dynamically linked with OpenSSL 3 via
[OpenSSL's provider model](https://docs.openssl.org/3.0/man7/crypto/#OPENSSL-PROVIDERS).
It is not necessary to rebuild Node.js to enable support for FIPS.
Node.js can use an OpenSSL FIPS provider via
[OpenSSL's provider model](https://docs.openssl.org/master/man7/crypto/#openssl-providers),
whether OpenSSL is linked statically or dynamically. It is not necessary to
rebuild Node.js to do so; the provider and the OpenSSL configuration that
activates it are supplied at runtime.
When using OpenSSL 1.1.1, Node.js must be built against a FIPS-capable OpenSSL.
Node.js does not build a FIPS provider. OpenSSL requires that a FIPS provider
be built from a release that carries a FIPS certificate, so a provider built
as part of the Node.js build would have no validation status.
See [FIPS mode](doc/api/crypto.md#fips-mode) for more information on how to
enable FIPS support in Node.js.
`./configure --openssl-is-fips` only records that the OpenSSL being linked is
FIPS capable, and requires `--shared-openssl`.
See [FIPS mode](doc/api/crypto.md#fips-mode) for how to configure it.
## Building Node.js with Temporal support
configure.py
+5 -5
View File
@@ -269,7 +269,8 @@ parser.add_argument('--openssl-is-fips',
action='store_true',
dest='openssl_is_fips',
default=None,
help='specifies that the OpenSSL library is FIPS compatible')
help='specifies that the shared OpenSSL library is FIPS capable '
'(requires --shared-openssl)')
parser.add_argument('--openssl-use-def-ca-store',
action='store_true',
@@ -2301,7 +2302,6 @@ def configure_openssl(o):
variables['node_shared_ngtcp2'] = b(options.shared_ngtcp2)
variables['node_shared_nghttp3'] = b(options.shared_nghttp3)
variables['openssl_is_fips'] = b(options.openssl_is_fips)
variables['node_fipsinstall'] = b(False)
if options.openssl_no_asm:
variables['openssl_no_asm'] = 1
@@ -2356,12 +2356,12 @@ def configure_openssl(o):
if options.openssl_no_asm and options.shared_openssl:
error('--openssl-no-asm is incompatible with --shared-openssl')
if options.openssl_is_fips and not options.shared_openssl:
error('--openssl-is-fips is only available with --shared-openssl')
if options.openssl_is_fips:
o['defines'] += ['OPENSSL_FIPS']
if options.openssl_is_fips and not options.shared_openssl:
variables['node_fipsinstall'] = b(True)
configure_library('openssl', o, with_separate_include_var=True)
o['variables']['openssl_version'] = get_openssl_version(o)
deps/openssl/openssl.gyp
Vendored
+1 -31
View File
@@ -98,36 +98,6 @@
},
}],
]
}, {
# openssl-fipsmodule target
'target_name': 'openssl-fipsmodule',
'type': 'shared_library',
'dependencies': ['openssl-cli'],
'includes': ['./openssl_common.gypi'],
'include_dirs+': ['openssl/apps/include'],
'cflags': [ '-fPIC' ],
#'ldflags': [ '-o', 'fips.so' ],
#'ldflags': [ '-Wl,--version-script=providers/fips.ld',],
'conditions': [
[ 'openssl_no_asm==1', {
'includes': ['./openssl-fips_no_asm.gypi'],
}, 'target_arch=="arm64" and OS=="win"', {
# VC-WIN64-ARM inherits from VC-noCE-common that has no asms.
'includes': ['./openssl-fips_no_asm.gypi'],
}, 'gas_version and v(gas_version) >= v("2.26") or '
'nasm_version and v(nasm_version) >= v("2.11.8") or '
'llvm_version and v(llvm_version) >= v("8.0")', {
# Require AVX512IFMA supported. See
# https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_ia32cap.html
# Currently crypto/poly1305/asm/poly1305-x86_64.pl requires AVX512IFMA.
'includes': ['./openssl-fips_asm.gypi'],
}, {
'includes': ['./openssl-fips_asm_avx2.gypi'],
}],
],
'direct_dependent_settings': {
'include_dirs': [ 'openssl/include', 'openssl/crypto/include']
}
},
},
]
}
node.gyp
+15 -80
View File
@@ -770,87 +770,22 @@
},
},
}],
['node_fipsinstall=="true"', {
'variables': {
'openssl-cli': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)openssl-cli<(EXECUTABLE_SUFFIX)',
'provider_name': 'libopenssl-fipsmodule',
'opensslconfig': './deps/openssl/nodejs-openssl.cnf',
'conditions': [
['GENERATOR == "ninja"', {
'fipsmodule_internal': '<(PRODUCT_DIR)/lib/<(provider_name).so',
'fipsmodule': '<(PRODUCT_DIR)/obj/lib/openssl-modules/fips.so',
'fipsconfig': '<(PRODUCT_DIR)/obj/lib/fipsmodule.cnf',
'opensslconfig_internal': '<(PRODUCT_DIR)/obj/lib/openssl.cnf',
}, {
'fipsmodule_internal': '<(PRODUCT_DIR)/obj.target/deps/openssl/<(provider_name).so',
'fipsmodule': '<(PRODUCT_DIR)/obj.target/deps/openssl/lib/openssl-modules/fips.so',
'fipsconfig': '<(PRODUCT_DIR)/obj.target/deps/openssl/fipsmodule.cnf',
'opensslconfig_internal': '<(PRODUCT_DIR)/obj.target/deps/openssl/openssl.cnf',
}],
],
},
'actions': [
{
'action_name': 'fipsinstall',
'process_outputs_as_sources': 1,
'inputs': [
'<(fipsmodule_internal)',
],
'outputs': [
'<(fipsconfig)',
],
'action': [
'<(openssl-cli)', 'fipsinstall',
'-provider_name', '<(provider_name)',
'-module', '<(fipsmodule_internal)',
'-out', '<(fipsconfig)',
#'-quiet',
],
},
{
'action_name': 'copy_fips_module',
'inputs': [
'<(fipsmodule_internal)',
],
'outputs': [
'<(fipsmodule)',
],
'action': [
'<(python)', 'tools/copyfile.py',
'<(fipsmodule_internal)',
'<(fipsmodule)',
],
},
{
'action_name': 'copy_openssl_cnf_and_include_fips_cnf',
'inputs': [ '<(opensslconfig)', ],
'outputs': [ '<(opensslconfig_internal)', ],
'action': [
'<(python)', 'tools/enable_fips_include.py',
'<(opensslconfig)',
'<(opensslconfig_internal)',
'<(fipsconfig)',
],
},
],
'variables': {
'opensslconfig_internal': '<(obj_dir)/deps/openssl/openssl.cnf',
'opensslconfig': './deps/openssl/nodejs-openssl.cnf',
},
'actions': [
{
'action_name': 'reset_openssl_cnf',
'inputs': [ '<(opensslconfig)', ],
'outputs': [ '<(opensslconfig_internal)', ],
'action': [
'<(python)', 'tools/copyfile.py',
'<(opensslconfig)',
'<(opensslconfig_internal)',
],
}, {
'variables': {
'opensslconfig_internal': '<(obj_dir)/deps/openssl/openssl.cnf',
'opensslconfig': './deps/openssl/nodejs-openssl.cnf',
},
'actions': [
{
'action_name': 'reset_openssl_cnf',
'inputs': [ '<(opensslconfig)', ],
'outputs': [ '<(opensslconfig_internal)', ],
'action': [
'<(python)', 'tools/copyfile.py',
'<(opensslconfig)',
'<(opensslconfig_internal)',
],
},
],
}],
},
],
}, # node_core_target_name
{
src/node_config.cc
-2
View File
@@ -64,8 +64,6 @@ static void InitConfig(Local<Object> target,
READONLY_FALSE_PROPERTY(target, "hasOpenSSL");
#endif // HAVE_OPENSSL
READONLY_TRUE_PROPERTY(target, "fipsMode");
#ifdef NODE_HAVE_I18N_SUPPORT
READONLY_TRUE_PROPERTY(target, "hasIntl");
tools/enable_fips_include.py
-42
View File
@@ -1,42 +0,0 @@
# Copyright 2008 the V8 project authors. All rights reserved.
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
# * Neither the name of Google Inc. nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
import sys
# Copy openssl.cnf into output directory
__import__('copyfile')
# Open the copied openssl.cnf file
fin = open(sys.argv[2], "rt")
data = fin.read()
data = data.replace('# .include fipsmodule.cnf', '.include %s' % sys.argv[3])
data = data.replace('# fips = fips_sect', 'fips = fips_sect')
data = data.replace('# activate = 1', 'activate = 1')
fin.close()
fin = open(sys.argv[2], "wt")
fin.write(data)
fin.close()
typings/internalBinding/config.d.ts
Vendored
-1
View File
@@ -2,7 +2,6 @@ export interface ConfigBinding {
isDebugBuild: boolean;
openSSLIsBoringSSL: boolean;
hasOpenSSL: boolean;
fipsMode: boolean;
hasIntl: boolean;
hasSmallICU: boolean;
hasTracing: boolean;