Skip to content

Add a check of the OPENSSL_FIPS environment variable around each call…

Rodrigo Muino Tomonari requested to merge github/fork/lordjabez/feature/make-fips-explicit into master

As currently implemented, when Node is compiled with FIPS support (./configure fips), there is no way to disable engaging FIPS mode during execution (Issue #3819 (closed)). This means that several functions that rely on non-FIPS approved algorithms (e.g. md5 hashing) will fail, as will any code that depends on them (most obviously, npm).

What seems needed to me is a way to explicitly enable or disable FIPS operation each time node is invoked. The way this is done with the openssl CLI is via the OPENSSL_FIPS environment variable.

This change adds a check to OPENSSL_FIPS at every place where FIPS_mode_set(1) is called (which enables FIPS mode). If Node is not compiled in FIPS mode these calls will not even be compiled since they're all wrapped with IFDEFs.

Those who are trying to run Node.js in FIPS mode should be familiar with this variable and using it will be natural.

Merge request reports