mirror of
https://github.com/nodejs/node.git
synced 2026-10-28 18:25:13 +08:00
Filip Skokan
d5d203a269
OpenSSL 3.4 added an indicator callback for operations that its FIPS provider allows after an approved-mode check has been relaxed. Publish these indicators on the crypto.fips.indicator diagnostics channel when Node.js is started with --enable-fips-indicator-events. Leave the OpenSSL callback unset otherwise so ordinary cryptographic operations have no indicator callback overhead. Keep the channel observation-only so enforcement remains the responsibility of the provider configuration, and independent diagnostic subscribers can coexist. Install the native callback during process initialization so it is not changed while Workers or thread-pool jobs can be using OpenSSL. Preserve callbacks installed by embedders, and queue bounded, coalesced messages for asynchronous delivery on the main environment. Document the channel as best-effort telemetry that cannot identify the originating call or establish FIPS validation. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: https://github.com/nodejs/node/pull/65645 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
67 lines
2.0 KiB
JavaScript
67 lines
2.0 KiB
JavaScript
// Flags: --expose-internals
|
|
'use strict';
|
|
|
|
const common = require('../common');
|
|
|
|
// The following tests assert that the node.cc PrintHelp() function
|
|
// returns the proper set of cli options when invoked
|
|
|
|
const assert = require('assert');
|
|
const { exec, spawn } = require('child_process');
|
|
const { once } = require('events');
|
|
let stdOut;
|
|
|
|
function startPrintHelpTest() {
|
|
exec(...common.escapePOSIXShell`"${process.execPath}" --help`, common.mustSucceed((stdout, stderr) => {
|
|
stdOut = stdout;
|
|
validateNodePrintHelp();
|
|
}));
|
|
}
|
|
|
|
function validateNodePrintHelp() {
|
|
const HAVE_OPENSSL = common.hasCrypto;
|
|
const NODE_HAVE_I18N_SUPPORT = common.hasIntl;
|
|
const HAVE_INSPECTOR = process.features.inspector;
|
|
|
|
const cliHelpOptions = [
|
|
{ compileConstant: HAVE_OPENSSL,
|
|
flags: [ '--openssl-config=...', '--tls-cipher-list=...',
|
|
'--use-bundled-ca', '--use-openssl-ca', '--use-system-ca',
|
|
'--enable-fips', '--enable-fips-indicator-events',
|
|
'--force-fips' ] },
|
|
{ compileConstant: NODE_HAVE_I18N_SUPPORT,
|
|
flags: [ '--icu-data-dir=...', 'NODE_ICU_DATA' ] },
|
|
{ compileConstant: HAVE_INSPECTOR,
|
|
flags: [ '--inspect-brk[=[host:]port]', '--inspect-port=[host:]port',
|
|
'--inspect[=[host:]port]' ] },
|
|
];
|
|
|
|
cliHelpOptions.forEach(testForSubstring);
|
|
}
|
|
|
|
function testForSubstring(options) {
|
|
if (options.compileConstant) {
|
|
for (const flag of options.flags) {
|
|
assert.notStrictEqual(stdOut.indexOf(flag), -1,
|
|
`Missing flag ${flag} in ${stdOut}`);
|
|
}
|
|
} else {
|
|
for (const flag of options.flags) {
|
|
assert.strictEqual(stdOut.indexOf(flag), -1,
|
|
`Unexpected flag ${flag} in ${stdOut}`);
|
|
}
|
|
}
|
|
}
|
|
|
|
startPrintHelpTest();
|
|
|
|
// Test closed stdout for `node --help`. Like `node --help | head -n5`.
|
|
(async () => {
|
|
const cp = spawn(process.execPath, ['--help'], {
|
|
stdio: ['inherit', 'pipe', 'inherit'],
|
|
});
|
|
cp.stdout.destroy();
|
|
const [exitCode] = await once(cp, 'exit');
|
|
assert.strictEqual(exitCode, 0);
|
|
})().then(common.mustCall());
|