diff options
| author | Fedor Indutny <fedor@indutny.com> | 2015-10-01 17:28:49 -0400 |
|---|---|---|
| committer | Fedor Indutny <fedor@indutny.com> | 2015-10-01 17:36:32 -0400 |
| commit | 9bd26e7ffaf34de5a083c580b51d9f443be2583c (patch) | |
| tree | 45dca060c55d715545e235f9f3c356631e6782da | |
| parent | 6be2a59235f42f19f9e64db384a95b6c9f6c64e0 (diff) | |
| download | node-new-9bd26e7ffaf34de5a083c580b51d9f443be2583c.tar.gz | |
crypto: enable FIPS only when configured with it
Do not rely on `OPENSSL_FIPS` in `node_crypto.cc` when building with
shared FIPS-enabled OpenSSL library. Enable FIPS in core only when
configured with `--openssl-fips`.
Fix: https://github.com/nodejs/node/issues/3077
PR-URL: https://github.com/nodejs/node/pull/3153
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
| -rw-r--r-- | node.gyp | 3 | ||||
| -rw-r--r-- | src/node_crypto.cc | 4 |
2 files changed, 5 insertions, 2 deletions
@@ -228,6 +228,9 @@ 'src/tls_wrap.h' ], 'conditions': [ + ['openssl_fips != ""', { + 'defines': [ 'NODE_FIPS_MODE' ], + }], [ 'node_shared_openssl=="false"', { 'dependencies': [ './deps/openssl/openssl.gyp:openssl', diff --git a/src/node_crypto.cc b/src/node_crypto.cc index bdfd1b62f3..6d5403b563 100644 --- a/src/node_crypto.cc +++ b/src/node_crypto.cc @@ -5323,13 +5323,13 @@ void InitCryptoOnce() { CRYPTO_set_locking_callback(crypto_lock_cb); CRYPTO_THREADID_set_callback(crypto_threadid_cb); -#ifdef OPENSSL_FIPS +#ifdef NODE_FIPS_MODE if (!FIPS_mode_set(1)) { int err = ERR_get_error(); fprintf(stderr, "openssl fips failed: %s\n", ERR_error_string(err, NULL)); UNREACHABLE(); } -#endif // OPENSSL_FIPS +#endif // NODE_FIPS_MODE // Turn off compression. Saves memory and protects against CRIME attacks. |