jiangcuo/node
1
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2025-05-15 16:01:52 +00:00
Code Issues Actions 12 Packages Projects Releases Wiki Activity

crypto: enable FIPS only when configured with it

Browse Source 
Do not rely on `OPENSSL_FIPS` in `node_crypto.cc` when building with
shared FIPS-enabled OpenSSL library. Enable FIPS in core only when
configured with `--openssl-fips`.

Fix: https://github.com/nodejs/node/issues/3077
PR-URL: https://github.com/nodejs/node/pull/3153
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
This commit is contained in:
Fedor Indutny 2015-10-01 17:28:49 -04:00
parent 6be2a59235
commit 9bd26e7ffa
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
node.gyp
View File

@ -228,6 +228,9 @@
'src/tls_wrap.h' 'src/tls_wrap.h'
], ],
'conditions': [ 'conditions': [
['openssl_fips != ""', {
'defines': [ 'NODE_FIPS_MODE' ],
}],
[ 'node_shared_openssl=="false"', { [ 'node_shared_openssl=="false"', {
'dependencies': [ 'dependencies': [
'./deps/openssl/openssl.gyp:openssl', './deps/openssl/openssl.gyp:openssl',

4
src/node_crypto.cc
View File

@ -5323,13 +5323,13 @@ void InitCryptoOnce() {
CRYPTO_set_locking_callback(crypto_lock_cb); CRYPTO_set_locking_callback(crypto_lock_cb);
CRYPTO_THREADID_set_callback(crypto_threadid_cb); CRYPTO_THREADID_set_callback(crypto_threadid_cb);
#ifdef OPENSSL_FIPS #ifdef NODE_FIPS_MODE
if (!FIPS_mode_set(1)) { if (!FIPS_mode_set(1)) {
int err = ERR_get_error(); int err = ERR_get_error();
fprintf(stderr, "openssl fips failed: %s\n", ERR_error_string(err, NULL)); fprintf(stderr, "openssl fips failed: %s\n", ERR_error_string(err, NULL));
UNREACHABLE(); UNREACHABLE();
} }
#endif // OPENSSL_FIPS #endif // NODE_FIPS_MODE
// Turn off compression. Saves memory and protects against CRIME attacks. // Turn off compression. Saves memory and protects against CRIME attacks.