Commit 21cfb2a4ad7 for nodejs
commit 21cfb2a4ad762eaa5ce18005e1b0ae16018b499c
Author: Filip Skokan <panva.ip@gmail.com>
Date: Mon Jul 27 01:17:22 2026 +0200
build: remove the bundled FIPS provider build
--openssl-is-fips with bundled OpenSSL never worked: the
openssl-fipsmodule target had no dependency edge, so fipsinstall's
input was produced by nothing. Repairing it would not help, since a
FIPS provider built out of tree has no validation status.
Remove the machinery and restrict --openssl-is-fips to --shared-openssl.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
diff --git a/BUILDING.md b/BUILDING.md
index 9ece644ce6f..e66d1974617 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -1026,14 +1026,20 @@ using the following configure option:
## Building Node.js with FIPS-compliant OpenSSL
-Node.js supports FIPS when statically or dynamically linked with OpenSSL 3 via
-[OpenSSL's provider model](https://docs.openssl.org/3.0/man7/crypto/#OPENSSL-PROVIDERS).
-It is not necessary to rebuild Node.js to enable support for FIPS.
+Node.js can use an OpenSSL FIPS provider via
+[OpenSSL's provider model](https://docs.openssl.org/master/man7/crypto/#openssl-providers),
+whether OpenSSL is linked statically or dynamically. It is not necessary to
+rebuild Node.js to do so; the provider and the OpenSSL configuration that
+activates it are supplied at runtime.
-When using OpenSSL 1.1.1, Node.js must be built against a FIPS-capable OpenSSL.
+Node.js does not build a FIPS provider. OpenSSL requires that a FIPS provider
+be built from a release that carries a FIPS certificate, so a provider built
+as part of the Node.js build would have no validation status.
-See [FIPS mode](doc/api/crypto.md#fips-mode) for more information on how to
-enable FIPS support in Node.js.
+`./configure --openssl-is-fips` only records that the OpenSSL being linked is
+FIPS capable, and requires `--shared-openssl`.
+
+See [FIPS mode](doc/api/crypto.md#fips-mode) for how to configure it.
## Building Node.js with Temporal support
diff --git a/configure.py b/configure.py
index 25b735e7e24..298c7eb1cb1 100755
--- a/configure.py
+++ b/configure.py
@@ -269,7 +269,8 @@ parser.add_argument('--openssl-is-fips',
action='store_true',
dest='openssl_is_fips',
default=None,
- help='specifies that the OpenSSL library is FIPS compatible')
+ help='specifies that the shared OpenSSL library is FIPS capable '
+ '(requires --shared-openssl)')
parser.add_argument('--openssl-use-def-ca-store',
action='store_true',
@@ -2301,7 +2302,6 @@ def configure_openssl(o):
variables['node_shared_ngtcp2'] = b(options.shared_ngtcp2)
variables['node_shared_nghttp3'] = b(options.shared_nghttp3)
variables['openssl_is_fips'] = b(options.openssl_is_fips)
- variables['node_fipsinstall'] = b(False)
if options.openssl_no_asm:
variables['openssl_no_asm'] = 1
@@ -2356,12 +2356,12 @@ def configure_openssl(o):
if options.openssl_no_asm and options.shared_openssl:
error('--openssl-no-asm is incompatible with --shared-openssl')
+ if options.openssl_is_fips and not options.shared_openssl:
+ error('--openssl-is-fips is only available with --shared-openssl')
+
if options.openssl_is_fips:
o['defines'] += ['OPENSSL_FIPS']
- if options.openssl_is_fips and not options.shared_openssl:
- variables['node_fipsinstall'] = b(True)
-
configure_library('openssl', o, with_separate_include_var=True)
o['variables']['openssl_version'] = get_openssl_version(o)
diff --git a/deps/openssl/openssl.gyp b/deps/openssl/openssl.gyp
index 144085fd33d..d11f72a758d 100644
--- a/deps/openssl/openssl.gyp
+++ b/deps/openssl/openssl.gyp
@@ -98,36 +98,6 @@
},
}],
]
- }, {
- # openssl-fipsmodule target
- 'target_name': 'openssl-fipsmodule',
- 'type': 'shared_library',
- 'dependencies': ['openssl-cli'],
- 'includes': ['./openssl_common.gypi'],
- 'include_dirs+': ['openssl/apps/include'],
- 'cflags': [ '-fPIC' ],
- #'ldflags': [ '-o', 'fips.so' ],
- #'ldflags': [ '-Wl,--version-script=providers/fips.ld',],
- 'conditions': [
- [ 'openssl_no_asm==1', {
- 'includes': ['./openssl-fips_no_asm.gypi'],
- }, 'target_arch=="arm64" and OS=="win"', {
- # VC-WIN64-ARM inherits from VC-noCE-common that has no asms.
- 'includes': ['./openssl-fips_no_asm.gypi'],
- }, 'gas_version and v(gas_version) >= v("2.26") or '
- 'nasm_version and v(nasm_version) >= v("2.11.8") or '
- 'llvm_version and v(llvm_version) >= v("8.0")', {
- # Require AVX512IFMA supported. See
- # https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_ia32cap.html
- # Currently crypto/poly1305/asm/poly1305-x86_64.pl requires AVX512IFMA.
- 'includes': ['./openssl-fips_asm.gypi'],
- }, {
- 'includes': ['./openssl-fips_asm_avx2.gypi'],
- }],
- ],
- 'direct_dependent_settings': {
- 'include_dirs': [ 'openssl/include', 'openssl/crypto/include']
- }
- },
+ },
]
}
diff --git a/node.gyp b/node.gyp
index a8ec3d5351a..1141736d3c4 100644
--- a/node.gyp
+++ b/node.gyp
@@ -770,87 +770,22 @@
},
},
}],
- ['node_fipsinstall=="true"', {
- 'variables': {
- 'openssl-cli': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)openssl-cli<(EXECUTABLE_SUFFIX)',
- 'provider_name': 'libopenssl-fipsmodule',
- 'opensslconfig': './deps/openssl/nodejs-openssl.cnf',
- 'conditions': [
- ['GENERATOR == "ninja"', {
- 'fipsmodule_internal': '<(PRODUCT_DIR)/lib/<(provider_name).so',
- 'fipsmodule': '<(PRODUCT_DIR)/obj/lib/openssl-modules/fips.so',
- 'fipsconfig': '<(PRODUCT_DIR)/obj/lib/fipsmodule.cnf',
- 'opensslconfig_internal': '<(PRODUCT_DIR)/obj/lib/openssl.cnf',
- }, {
- 'fipsmodule_internal': '<(PRODUCT_DIR)/obj.target/deps/openssl/<(provider_name).so',
- 'fipsmodule': '<(PRODUCT_DIR)/obj.target/deps/openssl/lib/openssl-modules/fips.so',
- 'fipsconfig': '<(PRODUCT_DIR)/obj.target/deps/openssl/fipsmodule.cnf',
- 'opensslconfig_internal': '<(PRODUCT_DIR)/obj.target/deps/openssl/openssl.cnf',
- }],
- ],
- },
- 'actions': [
- {
- 'action_name': 'fipsinstall',
- 'process_outputs_as_sources': 1,
- 'inputs': [
- '<(fipsmodule_internal)',
- ],
- 'outputs': [
- '<(fipsconfig)',
- ],
- 'action': [
- '<(openssl-cli)', 'fipsinstall',
- '-provider_name', '<(provider_name)',
- '-module', '<(fipsmodule_internal)',
- '-out', '<(fipsconfig)',
- #'-quiet',
- ],
- },
- {
- 'action_name': 'copy_fips_module',
- 'inputs': [
- '<(fipsmodule_internal)',
- ],
- 'outputs': [
- '<(fipsmodule)',
- ],
- 'action': [
- '<(python)', 'tools/copyfile.py',
- '<(fipsmodule_internal)',
- '<(fipsmodule)',
- ],
- },
- {
- 'action_name': 'copy_openssl_cnf_and_include_fips_cnf',
- 'inputs': [ '<(opensslconfig)', ],
- 'outputs': [ '<(opensslconfig_internal)', ],
- 'action': [
- '<(python)', 'tools/enable_fips_include.py',
- '<(opensslconfig)',
- '<(opensslconfig_internal)',
- '<(fipsconfig)',
- ],
- },
+ ],
+ 'variables': {
+ 'opensslconfig_internal': '<(obj_dir)/deps/openssl/openssl.cnf',
+ 'opensslconfig': './deps/openssl/nodejs-openssl.cnf',
+ },
+ 'actions': [
+ {
+ 'action_name': 'reset_openssl_cnf',
+ 'inputs': [ '<(opensslconfig)', ],
+ 'outputs': [ '<(opensslconfig_internal)', ],
+ 'action': [
+ '<(python)', 'tools/copyfile.py',
+ '<(opensslconfig)',
+ '<(opensslconfig_internal)',
],
- }, {
- 'variables': {
- 'opensslconfig_internal': '<(obj_dir)/deps/openssl/openssl.cnf',
- 'opensslconfig': './deps/openssl/nodejs-openssl.cnf',
- },
- 'actions': [
- {
- 'action_name': 'reset_openssl_cnf',
- 'inputs': [ '<(opensslconfig)', ],
- 'outputs': [ '<(opensslconfig_internal)', ],
- 'action': [
- '<(python)', 'tools/copyfile.py',
- '<(opensslconfig)',
- '<(opensslconfig_internal)',
- ],
- },
- ],
- }],
+ },
],
}, # node_core_target_name
{
diff --git a/src/node_config.cc b/src/node_config.cc
index 7245d9130d0..2de1ee244dd 100644
--- a/src/node_config.cc
+++ b/src/node_config.cc
@@ -64,8 +64,6 @@ static void InitConfig(Local<Object> target,
READONLY_FALSE_PROPERTY(target, "hasOpenSSL");
#endif // HAVE_OPENSSL
- READONLY_TRUE_PROPERTY(target, "fipsMode");
-
#ifdef NODE_HAVE_I18N_SUPPORT
READONLY_TRUE_PROPERTY(target, "hasIntl");
diff --git a/tools/enable_fips_include.py b/tools/enable_fips_include.py
deleted file mode 100644
index cb24c7d83b6..00000000000
--- a/tools/enable_fips_include.py
+++ /dev/null
@@ -1,42 +0,0 @@
-# Copyright 2008 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-# * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-# * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following
-# disclaimer in the documentation and/or other materials provided
-# with the distribution.
-# * Neither the name of Google Inc. nor the names of its
-# contributors may be used to endorse or promote products derived
-# from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-import sys
-
-# Copy openssl.cnf into output directory
-__import__('copyfile')
-
-# Open the copied openssl.cnf file
-fin = open(sys.argv[2], "rt")
-data = fin.read()
-data = data.replace('# .include fipsmodule.cnf', '.include %s' % sys.argv[3])
-data = data.replace('# fips = fips_sect', 'fips = fips_sect')
-data = data.replace('# activate = 1', 'activate = 1')
-fin.close()
-fin = open(sys.argv[2], "wt")
-fin.write(data)
-fin.close()
diff --git a/typings/internalBinding/config.d.ts b/typings/internalBinding/config.d.ts
index 5651b391b88..e85f1a815a8 100644
--- a/typings/internalBinding/config.d.ts
+++ b/typings/internalBinding/config.d.ts
@@ -2,7 +2,6 @@ export interface ConfigBinding {
isDebugBuild: boolean;
openSSLIsBoringSSL: boolean;
hasOpenSSL: boolean;
- fipsMode: boolean;
hasIntl: boolean;
hasSmallICU: boolean;
hasTracing: boolean;