GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — crypto: do not allow to call setFips from the worker thread · nodejs/node@a1653ac

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

lib
- crypto.js
src/crypto
- crypto_util.cc
test/parallel
- test-crypto-fips.js

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎lib/crypto.js‎`

Copy file name to clipboardExpand all lines: lib/crypto.js

+10Lines changed: 10 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,7 @@ assertCrypto();`
`37`	`37`
`38`	`38`	`const {`
`39`	`39`	`ERR_CRYPTO_FIPS_FORCED,`
	`40`	`+ ERR_WORKER_UNSUPPORTED_OPERATION,`
`40`	`41`	`} = require('internal/errors').codes;`
`41`	`42`	`const constants = internalBinding('constants').crypto;`
`42`	`43`	`const { getOptionValue } = require('internal/options');`
`@@ -127,6 +128,12 @@ function lazyWebCrypto() {`
`127`	`128`	`return webcrypto;`
`128`	`129`	`}`
`129`	`130`
	`131`	`+let ownsProcessState;`
	`132`	`+function lazyOwnsProcessState() {`
	`133`	`+ ownsProcessState ??= require('internal/worker').ownsProcessState;`
	`134`	`+ return ownsProcessState;`
	`135`	`+}`
	`136`	`+`
`130`	`137`	`// These helper functions are needed because the constructors can`
`131`	`138`	`// use new, in which case V8 cannot inline the recursive constructor call`
`132`	`139`	`function createHash(algorithm, options) {`
`@@ -250,6 +257,9 @@ function setFips(val) {`
`250`	`257`	`if (val) return;`
`251`	`258`	`throw new ERR_CRYPTO_FIPS_FORCED();`
`252`	`259`	`} else {`
	`260`	`+ if (!lazyOwnsProcessState()) {`
	`261`	`+ throw new ERR_WORKER_UNSUPPORTED_OPERATION('Calling crypto.setFips()');`
	`262`	`+ }`
`253`	`263`	`setFipsCrypto(val);`
`254`	`264`	`}`
`255`	`265`	`}`

Collapse file

`‎src/crypto/crypto_util.cc‎`

Copy file name to clipboardExpand all lines: src/crypto/crypto_util.cc

+1-2Lines changed: 1 addition & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -218,8 +218,7 @@ void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {`
`218`	`218`
`219`	`219`	`CHECK(!per_process::cli_options->force_fips_crypto);`
`220`	`220`	`Environment* env = Environment::GetCurrent(args);`
`221`		`- // TODO(addaleax): This should not be possible to set from worker threads.`
`222`		`- // CHECK(env->owns_process_state());`
	`221`	`+ CHECK(env->owns_process_state());`
`223`	`222`	`bool enable = args[0]->BooleanValue(env->isolate());`
`224`	`223`
`225`	`224`	`#if OPENSSL_VERSION_MAJOR >= 3`

Collapse file

`‎test/parallel/test-crypto-fips.js‎`

Copy file name to clipboardExpand all lines: test/parallel/test-crypto-fips.js

+8Lines changed: 8 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -85,6 +85,14 @@ testHelper(`
`85`	`85`	`'require("crypto").getFips()',`
`86`	`86`	`{ ...process.env, 'OPENSSL_CONF': ' ' });`
`87`	`87`
	`88`	`+// Toggling fips with setFips should not be allowed from a worker thread`
	`89`	`+testHelper(`
	`90`	`+ 'stderr',`
	`91`	`+ [],`
	`92`	`+ 'Calling crypto.setFips() is not supported in workers',`
	`93`	`+ 'new worker_threads.Worker(\'require("crypto").setFips(true);\', { eval: true })',`
	`94`	`+ process.env);`
	`95`	`+`
`88`	`96`	`// This should succeed for both FIPS and non-FIPS builds in combination with`
`89`	`97`	`// OpenSSL 1.1.1 or OpenSSL 3.0`
`90`	`98`	`const test_result = testFipsCrypto();`

0 commit comments

Comments

0 (0)

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.