Skip to content

FIPS and shared openssl #3077

Closed
Closed
FIPS and shared openssl#3077
Labels
buildIssues and PRs related to Node.js builds or CI infrastructure.opensslIssues and PRs related to the OpenSSL dependency.

Description

@Nibbler999
Nibbler999
opened on Sep 26, 2015

If you build against the system openssl in Fedora 23 (1.0.2d-fips) node tries to enable FIPS. This causes around 100 test failures/crashes. It would be better if it only enabled FIPS if you explicitly use --openssl-fips

Activity

  1. mscdex
    added
    opensslIssues and PRs related to the OpenSSL dependency.
    buildIssues and PRs related to Node.js builds or CI infrastructure.
    on Sep 26, 2015

  2. develop7 commented on Oct 1, 2015

    @develop7
    develop7
    on Oct 1, 2015

    +1 here — we openSUSE Tumbleweed users ran into this issue as well, see https://bugzilla.opensuse.org/show_bug.cgi?id=947747

  3. develop7 commented on Oct 1, 2015

    @develop7
    develop7
    on Oct 1, 2015

    @Nibbler999 there's hack that works this around should you need it — https://build.opensuse.org/package/view_file/home:msmeissn:branches:devel:languages:nodejs/nodejs/nodejs-no-fips.patch?rev=2

  4. develop7 commented on Oct 1, 2015

    @develop7
    develop7
    on Oct 1, 2015

    /cc @indutny :)

  5. indutny
    added a commit that references this issue on Oct 1, 2015

    crypto: enable FIPS only when configured with it

    69510a7

  6. indutny commented on Oct 1, 2015

    @indutny
    indutny
    on Oct 1, 2015
    Member

    Should be fixed by #3153. Thanks!

  7. indutny
    closed this as completedin 9bd26e7on Oct 1, 2015

  8. indutny commented on Oct 1, 2015

    @indutny
    indutny
    on Oct 1, 2015
    Member

    Fixed in 9bd26e7

  9. Nibbler999 commented on Oct 1, 2015

    @Nibbler999
    Nibbler999
    on Oct 1, 2015
    Author

    Fix confirmed, thanks!

  10. indutny
    added a commit that references this issue on Oct 2, 2015

    crypto: enable FIPS only when configured with it

    f055a66

  11. kasicka commented on Aug 23, 2017

    @kasicka
    kasicka
    on Aug 23, 2017

    So, is there a way to have FIPS and shared openssl?

  12. bnoordhuis commented on Aug 23, 2017

    @bnoordhuis
    bnoordhuis
    on Aug 23, 2017
    Member

    @kasicka Does node --enable-fips or node --force-fips work?

  13. kasicka commented on Aug 31, 2017

    @kasicka
    kasicka
    on Aug 31, 2017

    Built on system without fips enabled:

    [root@localhost asdf]# cat /proc/sys/crypto/fips_enabled
1
[root@localhost asdf]# node --enable-fips
node: bad option: --enable-fips
[root@localhost asdf]# node --force-fips
node: bad option: --force-fips

    Built on system with enabled fips has the same results, multiple tests failed.
    Also:

    [root@localhost asdf]# node -p "process.versions.openssl"
1.0.2k-fips

    I did not build it with --openssl-fips, because the fips functionality should be provided by openssl and I wasn't sure what to supply to the option.

  14. sjarmak
    added a commit that references this issue on Jul 27, 2026

    crypto: enable FIPS only when configured with it

    9bd26e7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    buildIssues and PRs related to Node.js builds or CI infrastructure.opensslIssues and PRs related to the OpenSSL dependency.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions