GeezerVison is showing github.com — crypto: don't assume FIPS is disabled by default · nodejs/node@effdca8
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: src/crypto/crypto_util.cc +2-1Lines changed: 2 additions & 1 deletion | Original file line number | Diff line number | Diff line change |
|---|
@@ -120,7 +120,8 @@ bool ProcessFipsOptions() { |
120 | 120 | return EVP_default_properties_enable_fips(nullptr, 1) && |
121 | 121 | EVP_default_properties_is_fips_enabled(nullptr); |
122 | 122 | #else |
123 | | - return FIPS_mode() == 0 && FIPS_mode_set(1); |
| 123 | + if (FIPS_mode() == 0) return FIPS_mode_set(1); |
| 124 | + |
124 | 125 | #endif |
125 | 126 | } |
126 | 127 | return true; |
|
Collapse file
Copy file name to clipboardExpand all lines: test/parallel/test-crypto-fips.js +11-7Lines changed: 11 additions & 7 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -77,13 +77,17 @@ testHelper( |
77 | 77 | 'process.versions', |
78 | 78 | process.env); |
79 | 79 |
|
80 | | -// By default FIPS should be off in both FIPS and non-FIPS builds. |
81 | | -testHelper( |
82 | | - 'stdout', |
83 | | - [], |
84 | | - FIPS_DISABLED, |
85 | | - 'require("crypto").getFips()', |
86 | | - { ...process.env, 'OPENSSL_CONF': ' ' }); |
| 80 | +// By default FIPS should be off in both FIPS and non-FIPS builds |
| 81 | +// unless Node.js was configured using --shared-openssl in |
| 82 | +// which case it may be enabled by the system. |
| 83 | +if (!sharedOpenSSL()) { |
| 84 | + testHelper( |
| 85 | + 'stdout', |
| 86 | + [], |
| 87 | + FIPS_DISABLED, |
| 88 | + 'require("crypto").getFips()', |
| 89 | + { ...process.env, 'OPENSSL_CONF': ' ' }); |
| 90 | +} |
87 | 91 |
|
88 | 92 | // This should succeed for both FIPS and non-FIPS builds in combination with |
89 | 93 | // OpenSSL 1.1.1 or OpenSSL 3.0 |
|