Add nodejs fips test #493

tjuhaszrh · 2025-06-18T13:14:52Z

Add two test cases to verify that if:

Container is in fips mode, node is also using fips mode.
Container isnt in fips mode, node also isnt using fips mode.

Nodejs fips state is verified with: node -e 'const crypto = require("crypto"); return crypto.getFips(); which should return the same value (1 for enabled, 0 for disabled) as cat "/proc/sys/crypto/fips_enabled".

phracek · 2025-06-19T07:21:27Z

Let's try first set of shots

[test]

github-actions · 2025-06-19T07:29:44Z

Testing Farm results

name	compose	arch	status	started (UTC)	time	logs
Fedora - 22-minimal	Fedora-latest	x86_64	✅ passed	26.06.2025 08:28:24	7min 35s	test pipeline
CentOS Stream 9 - 20-minimal	CentOS-Stream-9	x86_64	✅ passed	26.06.2025 08:28:22	7min 25s	test pipeline
Fedora - 22	Fedora-latest	x86_64	✅ passed	26.06.2025 08:28:25	9min	test pipeline
Fedora - 20	Fedora-latest	x86_64	✅ passed	26.06.2025 08:36:47	9min 22s	test pipeline
CentOS Stream 10 - 22-minimal	CentOS-Stream-10	x86_64	✅ passed	26.06.2025 08:28:35	7min 37s	test pipeline
CentOS Stream 9 - 20	CentOS-Stream-9	x86_64	✅ passed	26.06.2025 08:36:59	9min 8s	test pipeline
CentOS Stream 10 - 22	CentOS-Stream-10	x86_64	✅ passed	26.06.2025 08:28:36	8min 53s	test pipeline
RHEL9 - FIPS Enabled - 22-minimal	RHEL-9.6.0-Nightly	x86_64	✅ passed	26.06.2025 10:50:43	24min 1s	test pipeline
RHEL9 - FIPS Enabled - 20	RHEL-9.6.0-Nightly	x86_64	❌ error	26.06.2025 08:28:24	16min 21s	test pipeline
RHEL10 - 22-minimal	RHEL-10-Nightly	x86_64	✅ passed	26.06.2025 08:28:23	14min 42s	test pipeline
RHEL8 - 22	RHEL-8.10.0-Nightly	x86_64	✅ passed	26.06.2025 08:36:37	20min 20s	test pipeline
RHEL10 - 22	RHEL-10-Nightly	x86_64	✅ passed	26.06.2025 08:28:51	17min 17s	test pipeline
RHEL8 - 22-minimal	RHEL-8.10.0-Nightly	x86_64	✅ passed	26.06.2025 08:28:25	17min 25s	test pipeline
RHEL10 - FIPS Enabled - 22-minimal	RHEL-10-Nightly	x86_64	❌ error	26.06.2025 12:20:26	17min 18s	test pipeline
RHEL9 - FIPS Enabled - 20-minimal	RHEL-9.6.0-Nightly	x86_64	✅ passed	26.06.2025 10:50:43	22min 54s	test pipeline
RHEL10 - FIPS Enabled - 22	RHEL-10-Nightly	x86_64	❌ error	26.06.2025 11:51:42	16min 17s	test pipeline
RHEL9 - FIPS Enabled - 22	RHEL-9.6.0-Nightly	x86_64	✅ passed	26.06.2025 10:50:44	25min 54s	test pipeline
RHEL9 - 22-minimal	RHEL-9.4.0-Nightly	x86_64	✅ passed	25.06.2025 12:25:56	57min 56s	test pipeline
RHEL8 - 20-minimal	RHEL-8.10.0-Nightly	x86_64	✅ passed	26.06.2025 08:28:35	18min 2s	test pipeline
RHEL8 - 20	RHEL-8.10.0-Nightly	x86_64	✅ passed	26.06.2025 08:28:33	18min 5s	test pipeline
RHEL9 - 20-minimal	RHEL-9.6.0-Nightly	x86_64	✅ passed	26.06.2025 08:28:25	18min 40s	test pipeline
RHEL9 - 22	RHEL-9.6.0-Nightly	x86_64	✅ passed	26.06.2025 08:38:47	20min 29s	test pipeline
Fedora - 20-minimal	Fedora-latest	x86_64	✅ passed	26.06.2025 08:28:25	8min 5s	test pipeline
RHEL9 - 20	RHEL-9.6.0-Nightly	x86_64	✅ passed	26.06.2025 08:28:24	20min 56s	test pipeline

phracek · 2025-06-19T07:36:18Z

@tjuhaszrh The error is here:

Running test test_nodejs_fips_mode_off (starting at 2025-06-19 07:27:56+00:00) ... 
-----------------------------------------------
[eval]:1
(crypto=>{{const crypto = require(crypto); return crypto.getFips();}})(require('node:crypto'))
                                  ^

ReferenceError: Cannot access 'crypto' before initialization
    at [eval]:1:35
    at [eval]:1:71
    at runScriptInThisContext (node:internal/vm:209:10)
    at node:internal/process/execution:449:12
    at [eval]-wrapper:6:24
    at runScriptInContext (node:internal/process/execution:447:60)
    at evalFunction (node:internal/process/execution:87:30)
    at evalScript (node:internal/process/execution:99:3)
    at node:internal/main/eval_string:74:3

Node.js v22.15.0

phracek · 2025-06-19T10:24:22Z

@tjuhaszrh Thanks for this pull request. I have several question regarding nodeJs.

What do you thinkg about this code?

function test_nodejs_fips_mode_off() {
  local ret_val
  local is_fips_enabled
  # Read fips mode from host in case exists
  if [[ -f /proc/sys/crypto/fips_enabled ]]; then
    is_fips_enabled=$(cat /proc/sys/crypto/fips_enabled)
  else
    # Set to 0 if not exists
    is_fips_enabled="0"
  fi
  if [[ "$is_fips_enabled" == "0" ]]; then
    echo "FIPS is disabled on host"
    echo "What is expected output in case disabled fips???"
    fips=$(docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "! node -e 'const crypto = require("crypto"); return crypto.getFips();'")
    echo "FIPS from app: '$fips'" # For me $fips is empty...
    if [[ "$fips" == "" ]]; then
      ct_check_testcase_result "0"
    else
      ct_check_testcase_result "$retval"
    fi
  else
    # What is expected behavior here in case FIPS is enabled and we test for fips is disabled. Does it make sense either?
    # Check fips mode in container as well
    if docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "cat /proc/sys/crypto/fips_enabled | grep -q 0"; then
      fips=$(docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "node -e 'const crypto = require("crypto"); return crypto.getFips();'")
      echo "FIPS from app: '$fips'"
      ct_check_testcase_result "$?"
    fi
  fi
}

tjuhaszrh · 2025-06-19T14:42:32Z

[test]

tjuhaszrh · 2025-06-19T14:53:05Z

Sorry I think the issue was caused just by messy string nesting in require("crypto") .

Adding backslash seems to have fixed it.

➜  test git:(fips-nodejs) fips=$(podman run --rm localhost/node-app:latest /bin/bash -c "! node -e 'const crypto = require("crypto"); return crypto.getFips();'")             
[eval]:1
(crypto=>{{const crypto = require(crypto); return crypto.getFips();}})(require('node:crypto'))
                                  ^

ReferenceError: Cannot access 'crypto' before initialization
    at [eval]:1:35
    at [eval]:1:71
    at runScriptInThisContext (node:internal/vm:209:10)
    at node:internal/process/execution:118:14
    at [eval]-wrapper:6:24
    at runScript (node:internal/process/execution:101:62)
    at evalScript (node:internal/process/execution:133:3)
    at node:internal/main/eval_string:51:3

Node.js v20.19.2
➜  test git:(fips-nodejs) fips=$(podman run --rm localhost/node-app:latest /bin/bash -c "! node -e 'const crypto = require(\"crypto\"); return crypto.getFips();'")           
➜  test git:(fips-nodejs)

tjuhaszrh · 2025-06-19T15:23:41Z

@tjuhaszrh Thanks for this pull request. I have several question regarding nodeJs.

What do you thinkg about this code?

function test_nodejs_fips_mode_off() {
  local ret_val
  local is_fips_enabled
  # Read fips mode from host in case exists
  if [[ -f /proc/sys/crypto/fips_enabled ]]; then
    is_fips_enabled=$(cat /proc/sys/crypto/fips_enabled)
  else
    # Set to 0 if not exists
    is_fips_enabled="0"
  fi
  if [[ "$is_fips_enabled" == "0" ]]; then
    echo "FIPS is disabled on host"
    echo "What is expected output in case disabled fips???"
    fips=$(docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "! node -e 'const crypto = require("crypto"); return crypto.getFips();'")
    echo "FIPS from app: '$fips'" # For me $fips is empty...
    if [[ "$fips" == "" ]]; then
      ct_check_testcase_result "0"
    else
      ct_check_testcase_result "$retval"
    fi
  else
    # What is expected behavior here in case FIPS is enabled and we test for fips is disabled. Does it make sense either?
    # Check fips mode in container as well
    if docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "cat /proc/sys/crypto/fips_enabled | grep -q 0"; then
      fips=$(docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "node -e 'const crypto = require("crypto"); return crypto.getFips();'")
      echo "FIPS from app: '$fips'"
      ct_check_testcase_result "$?"
    fi
  fi
}

My understanding is that crypto.getFips(); returns exactly the same values as cat /proc/sys/crypto/fips_enabled (so 1 for enabled, 0 for disabled fips).

My usage of the fips variable was also wrong since I only care about the $? value and it doesn't store anything, I got slightly to inspired by the nodemon test.

So I think:
if [[ "$is_fips_enabled" == "0" ]]; then echo "FIPS is disabled on host" echo "What is expected output in case disabled fips???" fips=$(docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "! node -e 'const crypto = require("crypto"); return crypto.getFips();'") echo "FIPS from app: '$fips'" # For me $fips is empty... if [[ "$fips" == "" ]]; then ct_check_testcase_result "0" else ct_check_testcase_result "$retval" fi
this would probably always pass.

tjuhaszrh · 2025-06-19T15:45:15Z

Adjustments:

removed unused variable fips.
moved the logic into one function that verifies both states of fips mode.
added check for presence of /proc/sys/crypto/fips_enabled file.

mhdawson · 2025-06-19T21:37:16Z

Great to see this test being added

phracek · 2025-06-20T07:10:14Z

[test]

phracek · 2025-06-23T08:16:02Z

Great to see this test being added

Hi @mhdawson , does it make sense to test also some a simple app, like we have in directory test-app (https://github.com/sclorg/s2i-nodejs-container/tree/master/test/test-app) also for FIPS mode? But may be with different name, like test-fips? What do you think?

phracek

It is almost done. Thanks for this pull request. Great work.

test/test-lib-nodejs.sh

phracek · 2025-06-23T14:16:37Z

[test]

mhdawson · 2025-06-23T15:49:14Z

@phracek a simple test application would be a good idea as well.

phracek · 2025-06-24T07:48:17Z

@tjuhaszrh Add to this pull request also fips https://github.com/sclorg/s2i-nodejs-container/blob/master/test/test-lib-nodejs.sh#L133
The code should be like

    app|hw|fips|express-webapp|binary)
      pushd "${test_dir}/test-${1}" >/dev/null
      prepare_dummy_git_repo
      popd >/dev/null
      ;;

Add there also function like is here https://github.com/sclorg/s2i-nodejs-container/blob/master/test/test-lib-nodejs.sh#L44

run_s2i_build_fips() {
  ct_s2i_build_as_df file://${test_dir}/test-fips ${IMAGE_NAME} ${IMAGE_NAME}-testfips ${s2i_args} $(ct_build_s2i_npm_variables) $1
}

tjuhaszrh · 2025-06-25T09:35:34Z

Added a simple app that in the context of a server verifies what kind of Hash algorithms and Ciphers are allowed to be used under FIPS.

Allowed: SHA256, AES
Not allowed: MLD, 3DES with only two keys.

phracek

Thanks for the new app. Please address my changes.

test/run

test/test-lib-nodejs.sh

test/run

Add test that verifies that if: Container is in fips mode, node is also using fips mode. Container isnt in fips mode, node also isnt using fips mode. Add simple Fips application which in the context of server verifies: * That FIPS allows the generation of only secure hash algorithms and ciphers. * Should allow: SHA256, AES. Should Fail: MLD, 2Key 3DES.

Couple test fixes caught by testing on RHEL9 host. Signed-off-by: Petr "Stone" Hracek <phracek@redhat.com>

phracek · 2025-06-25T12:25:37Z

Rebased against upstream. Fixing some tests.

[test]

phracek · 2025-06-26T08:28:07Z

Let's tests one more time

[test]

phracek

The tests have passed. GREAT WORK. THank you

tjuhaszrh force-pushed the fips-nodejs branch from d3e5d1f to 795f826 Compare June 19, 2025 14:42

tjuhaszrh force-pushed the fips-nodejs branch 2 times, most recently from c36fca6 to 415e2cd Compare June 19, 2025 15:44

tjuhaszrh force-pushed the fips-nodejs branch 2 times, most recently from 364e024 to 31dd709 Compare June 23, 2025 08:15

tjuhaszrh force-pushed the fips-nodejs branch from 31dd709 to 51e15e1 Compare June 23, 2025 08:23

phracek requested changes Jun 23, 2025

View reviewed changes

test/test-lib-nodejs.sh Outdated Show resolved Hide resolved

test/test-lib-nodejs.sh Outdated Show resolved Hide resolved

test/test-lib-nodejs.sh Outdated Show resolved Hide resolved

tjuhaszrh force-pushed the fips-nodejs branch 2 times, most recently from cfff436 to 2c3f72f Compare June 23, 2025 08:50

tjuhaszrh requested a review from phracek June 23, 2025 09:27

tjuhaszrh force-pushed the fips-nodejs branch from 2c3f72f to 8f3e3b1 Compare June 25, 2025 09:31

phracek requested changes Jun 25, 2025

View reviewed changes

test/run Outdated Show resolved Hide resolved

test/run Outdated Show resolved Hide resolved

test/test-lib-nodejs.sh Outdated Show resolved Hide resolved

test/run Outdated Show resolved Hide resolved

tjuhaszrh force-pushed the fips-nodejs branch from 8f3e3b1 to d49312b Compare June 25, 2025 10:28

tjuhaszrh and others added 2 commits June 25, 2025 14:24

Add support for running FIPS aplication only for FIPS enabled host.

203a12f

Couple test fixes caught by testing on RHEL9 host. Signed-off-by: Petr "Stone" Hracek <phracek@redhat.com>

phracek force-pushed the fips-nodejs branch from 4522a28 to 203a12f Compare June 25, 2025 12:24

phracek approved these changes Jun 27, 2025

View reviewed changes

phracek added the READY-to-MERGE label Jun 27, 2025

phracek merged commit d9f9c28 into sclorg:master Jun 27, 2025
24 checks passed

This was referenced Jul 2, 2025

Add test suite in case of FIPS is enabled sclorg/s2i-ruby-container#590

Closed

Add test suite in case of FIPS is enabled sclorg/s2i-python-container#747

Open

Add nodejs fips test #493

Add nodejs fips test #493

Uh oh!

Conversation

tjuhaszrh commented Jun 18, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

phracek commented Jun 19, 2025

Uh oh!

github-actions bot commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing Farm results

Uh oh!

phracek commented Jun 19, 2025

Uh oh!

phracek commented Jun 19, 2025

Uh oh!

tjuhaszrh commented Jun 19, 2025

Uh oh!

tjuhaszrh commented Jun 19, 2025

Uh oh!

tjuhaszrh commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tjuhaszrh commented Jun 19, 2025

Uh oh!

mhdawson commented Jun 19, 2025

Uh oh!

phracek commented Jun 20, 2025

Uh oh!

phracek commented Jun 23, 2025

Uh oh!

phracek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

phracek commented Jun 23, 2025

Uh oh!

mhdawson commented Jun 23, 2025

Uh oh!

phracek commented Jun 24, 2025

Uh oh!

tjuhaszrh commented Jun 25, 2025

Uh oh!

phracek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

phracek commented Jun 25, 2025

Uh oh!

phracek commented Jun 26, 2025

Uh oh!

phracek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tjuhaszrh commented Jun 18, 2025 •

edited by github-actions bot

Loading

github-actions bot commented Jun 19, 2025 •

edited

Loading

tjuhaszrh commented Jun 19, 2025 •

edited

Loading