Skip to content

crypto: only try to set FIPS mode if different #12210

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gibfahn merged 1 commit into from
Sep 26, 2017
Merged

crypto: only try to set FIPS mode if different #12210

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions src/node_crypto.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6021,11 +6021,14 @@ void GetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
Environment* env = Environment::GetCurrent(args);
#ifdef NODE_FIPS_MODE
bool mode = args[0]->BooleanValue();
const bool enabled = FIPS_mode();
const bool enable = args[0]->BooleanValue();
if (enable == enabled)
return; // No action needed.
if (force_fips_crypto) {
Copy link
Member

@jasnell jasnell Apr 4, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given this change, should we also only throw if attempting to turn FIPS off when force_fips_crypto is on? Turning it on should likely just non-op

Copy link
Member Author

@gibfahn gibfahn Apr 4, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jasnell if force_fips_crypto is on, then FIPS_mode() should already be enabled right? So doesn't the if (enable == enabled) branch already cover that?

Copy link
Member

@jasnell jasnell Apr 4, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good point. ok

return env->ThrowError(
"Cannot set FIPS mode, it was forced with --force-fips at startup.");
} else if (!FIPS_mode_set(mode)) {
} else if (!FIPS_mode_set(enable)) {
unsigned long err = ERR_get_error(); // NOLINT(runtime/int)
return ThrowCryptoError(env, err);
}
Expand Down
9 changes: 9 additions & 0 deletions test/parallel/test-crypto-fips.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,6 +212,15 @@ testHelper(
'require("crypto").fips = false',
process.env);

// --force-fips makes setFipsCrypto enable a no-op (FIPS stays on)
testHelper(
compiledWithFips() ? 'stdout' : 'stderr',
['--force-fips'],
compiledWithFips() ? FIPS_ENABLED : OPTION_ERROR_STRING,
'(require("crypto").fips = true,' +
'require("crypto").fips)',
Copy link
Member

@BridgeAR BridgeAR Sep 24, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I personally would use a single line for this argument as all other arguments are also on a single line but that is just taste and does not have to be addressed.

Copy link
Member Author

@gibfahn gibfahn Sep 24, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I copied this from a test further up. There are a few things I'd change about this test file, but I thought I'd try to keep this diff clean.

process.env);

// --force-fips and --enable-fips order does not matter
testHelper(
'stderr',
Expand Down