1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

crypto: only try to set FIPS mode if different

Browse Source 
Turning FIPS mode on (or off) when it's already on (or off) should be a
no-op, not an error.

PR-URL: https://github.com/nodejs/node/pull/12210
Fixes: https://github.com/nodejs/node/issues/11849
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
This commit is contained in:
Gibson Fahnestock 2017-04-04 15:36:15 +01:00
parent 7d55b81999
commit 0919dff489
No known key found for this signature in database
GPG Key ID: B01FBB92821C587A
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/node_crypto.cc
View File

@ -6021,11 +6021,14 @@ void GetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) { void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
Environment* env = Environment::GetCurrent(args); Environment* env = Environment::GetCurrent(args);
#ifdef NODE_FIPS_MODE #ifdef NODE_FIPS_MODE
bool mode = args[0]->BooleanValue(); const bool enabled = FIPS_mode();
const bool enable = args[0]->BooleanValue();
if (enable == enabled)
return; // No action needed.
if (force_fips_crypto) { if (force_fips_crypto) {
return env->ThrowError( return env->ThrowError(
"Cannot set FIPS mode, it was forced with --force-fips at startup."); "Cannot set FIPS mode, it was forced with --force-fips at startup.");
} else if (!FIPS_mode_set(mode)) { } else if (!FIPS_mode_set(enable)) {
unsigned long err = ERR_get_error(); // NOLINT(runtime/int) unsigned long err = ERR_get_error(); // NOLINT(runtime/int)
return ThrowCryptoError(env, err); return ThrowCryptoError(env, err);
} }

9
test/parallel/test-crypto-fips.js
View File

@ -212,6 +212,15 @@ testHelper(
'require("crypto").fips = false', 'require("crypto").fips = false',
process.env); process.env);
// --force-fips makes setFipsCrypto enable a no-op (FIPS stays on)
testHelper(
compiledWithFips() ? 'stdout' : 'stderr',
['--force-fips'],
compiledWithFips() ? FIPS_ENABLED : OPTION_ERROR_STRING,
'(require("crypto").fips = true,' +
'require("crypto").fips)',
process.env);
// --force-fips and --enable-fips order does not matter // --force-fips and --enable-fips order does not matter
testHelper( testHelper(
'stderr', 'stderr',