Skip to content

src: raise error for --enable-fips when no FIPS

Rodrigo Muino Tomonari requested to merge github/fork/danbev/enable-fips-raise-error into master

This commit moves the check for FIPS from the crypto module initialization to process startup.

The motivation for this is that when OpenSSL is not FIPS enabled and the command line options --enable-fips, or --force-fips are used, there will only be an error raised if the crypto module is used. This can be surprising and we have gotten feedback that users assumed that there would be an error if these options were specified and FIPS is not available.

Example output using OpenSSL 1.1.1:

$ ./out/Release/node -p 'crypto.getFips()'
0

$ ./out/Release/node --enable-fips  -p 'crypto.getFips()'
OpenSSL error when trying to enable FIPS:
140252042856384:error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported:../deps/openssl/openssl/crypto/o_fips.c:22:

Example output using OpenSSL 3.0:

$ ./out/Release/node -p 'crypto.getFips()'
0

$ ./out/Release/node --enable-fips  -p 'crypto.getFips()'
OpenSSL error when trying to enable FIPS:
00A0462A9F7F0000:error:12800067:DSO support routines:dlfcn_load:could not load the shared library:crypto/dso/dso_dlfcn.c:118:filename(/home/danielbevenius/work/security/openssl_quic-3.0/lib/ossl-modules/fips.so): /home/danielbevenius/work/security/openssl_quic-3.0/lib/ossl-modules/fips.so: cannot open shared object file: No such file or directory
00A0462A9F7F0000:error:12800067:DSO support routines:DSO_load:could not load the shared library:crypto/dso/dso_lib.c:162:
00A0462A9F7F0000:error:078C0105:common libcrypto routines:provider_init:init fail:crypto/provider_core.c:657:name=fips

Merge request reports