build: introduce --openssl-is-fips flag #25412

danbev · 2019-01-09T11:25:52Z

This commit introduces a new configuration flag named
--openssl-is-fips which is intended to be used when linking against
an OpenSSL library that is FIPS compatible.

The motivation for this is that Red Hat Enterprise Linux 8 (RHEL8)
comes with OpenSSL 1.1.1 and includes FIPS support, and we would
like to be able to dynamically link against this version and also have
FIPS features enabled in node, like would be done when statically
linking and using the --openssl-fips flag.

The suggestion here is to introduce a new flag:

$ ./configure --help
...
--openssl-is-fips specifies that the shared OpenSSL library is FIPS
                  compatible

This flag could be used in combination with the --shared-openssl flag:

$ ./configure --shared-openssl --openssl-is-fips

This will enable FIPS support in node and the runtime flags will be
availalbe to enable FIPS (--enable-fips, --force-fips).

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
commit message follows commit guidelines

nodejs-github-bot · 2019-01-09T11:25:55Z

@danbev build started: https://ci.nodejs.org/blue/organizations/jenkins/node-test-pull-request-lite-pipeline/detail/node-test-pull-request-lite-pipeline/2198/pipeline

mhdawson · 2019-01-09T14:06:38Z

Do you have any more details on the FIPs certification that RedHat got for OpenSSL 1.1.1 that you can share?

sam-github · 2019-01-09T17:54:24Z

@danbev sorry to bike-shed on the config name, but I was a bit confused by why it had to exist until I read the configure code.

The problem is that we only specify FIPS build flags ATM when linking against a FIPS canister (--openssl-fips=canister.o).

Can we call the new flag --openssl-is-fips, and describe it as "specifies that the OpenSSL library is FIPS compatible"? This would sort it right next to --openssl-fips in the help output (I wish it had been called --openssl-fips-container=), and not in the shared section, where the flags all have a very nice predictable form and meaning ATM:

    --shared-cares      link to a shared cares DLL instead of static linking
    --shared-cares-includes=SHARED_LIBCARES_INCLUDES
    --shared-cares-libname=SHARED_LIBCARES_LIBNAME
    --shared-cares-libpath=SHARED_LIBCARES_LIBPATH
... etc for all the deps where shared is supported

danbev · 2019-01-09T19:33:27Z

Do you have any more details on the FIPs certification that RedHat got for OpenSSL 1.1.1 that you can share?

I'll try to find some information about this that I can share.

@sam-github I like the suggestion. I'll follow up on this on Friday (I'm not working tomorrow). Thanks

danbev · 2019-01-11T07:42:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/20058/

danbev · 2019-01-14T06:38:15Z

Re-run of failing node-test-commit-windows-fanned
Re-run of failing node-test-commit-arm-fanned

addaleax · 2019-01-14T17:12:15Z

CI: https://ci.nodejs.org/job/node-test-pull-request/20114/

danbev · 2019-01-15T08:21:00Z

Re-run of failing node-test-commit-arm

This commit introduces a new configuration flag named --openssl-is-fips which is intended to be used when linking against an OpenSSL library that is FIPS compatible. The motivation for this is that Red Hat Enterprise Linux 8 (RHEL8) comes with OpenSSL 1.1.1 and includes FIPS support, and we would like to be able to dynamically link against this version and also have FIPS features enabled in node, like would be done when statically linking and using the --openssl-fips flag. The suggestion here is to introduce a new flag: $ ./configure --help ... --openssl-is-fips specifies that the shared OpenSSL version is FIPS compatible This flag could be used in combination with the shared-openssl flag: $ ./configure --shared-openssl ---openssl-is-fips This will enable FIPS support in node and the runtime flags will be availalbe to enable FIPS (--enable-fips, --force-fips).

Currently, while FIPS is not supported yet for this release there might be an option to dynamically link against a FIPS compatible OpenSSL version. This commit fixes the compiler errors.

danbev · 2019-01-16T12:57:18Z

Re-based CI: https://ci.nodejs.org/job/node-test-pull-request/20164/

danbev · 2019-01-17T04:10:41Z

Re-run of failing node-test-commit-arm-fanned ✔️

danbev · 2019-01-17T04:32:13Z

Landed in 7e7266a, and 228a3f8.

This commit introduces a new configuration flag named --openssl-is-fips which is intended to be used when linking against an OpenSSL library that is FIPS compatible. The motivation for this is that Red Hat Enterprise Linux 8 (RHEL8) comes with OpenSSL 1.1.1 and includes FIPS support, and we would like to be able to dynamically link against this version and also have FIPS features enabled in node, like would be done when statically linking and using the --openssl-fips flag. The suggestion here is to introduce a new flag: $ ./configure --help ... --openssl-is-fips specifies that the shared OpenSSL version is FIPS compatible This flag could be used in combination with the shared-openssl flag: $ ./configure --shared-openssl ---openssl-is-fips This will enable FIPS support in node and the runtime flags will be availalbe to enable FIPS (--enable-fips, --force-fips). PR-URL: #25412 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>

Currently, while FIPS is not supported yet for this release there might be an option to dynamically link against a FIPS compatible OpenSSL version. This commit fixes the compiler errors. PR-URL: #25412 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>

This commit introduces a new configuration flag named --openssl-is-fips which is intended to be used when linking against an OpenSSL library that is FIPS compatible. The motivation for this is that Red Hat Enterprise Linux 8 (RHEL8) comes with OpenSSL 1.1.1 and includes FIPS support, and we would like to be able to dynamically link against this version and also have FIPS features enabled in node, like would be done when statically linking and using the --openssl-fips flag. The suggestion here is to introduce a new flag: $ ./configure --help ... --openssl-is-fips specifies that the shared OpenSSL version is FIPS compatible This flag could be used in combination with the shared-openssl flag: $ ./configure --shared-openssl ---openssl-is-fips This will enable FIPS support in node and the runtime flags will be availalbe to enable FIPS (--enable-fips, --force-fips). PR-URL: #25412 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>

Currently, while FIPS is not supported yet for this release there might be an option to dynamically link against a FIPS compatible OpenSSL version. This commit fixes the compiler errors. PR-URL: #25412 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>

danbev added the wip Issues and PRs that are still a work in progress. label Jan 9, 2019

nodejs-github-bot added the build Issues and PRs related to build files or the CI. label Jan 9, 2019

danbev force-pushed the crypto_dynlink_fips branch from e7194b3 to e0229a2 Compare January 11, 2019 07:38

danbev changed the title ~~build: introduce --shared-openssl-fips flag~~ build: introduce --openssl-is-fips flag Jan 11, 2019

danbev removed the wip Issues and PRs that are still a work in progress. label Jan 11, 2019

sam-github approved these changes Jan 11, 2019

View reviewed changes

addaleax approved these changes Jan 14, 2019

View reviewed changes

addaleax added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Jan 14, 2019

This was referenced Jan 16, 2019

CI failures: 20190110 - 20190116 nodejs/reliability#20

Closed

Investigate flaky known_issues/test-vm-timeout-escape-queuemicrotask #25529

Closed

Windows CI failures: parallel/test-trace-events-fs-sync #25512

Closed

danbev added 2 commits January 16, 2019 12:25

src: fix FIPS section in Sign::SignFinal

8856979

Currently, while FIPS is not supported yet for this release there might be an option to dynamically link against a FIPS compatible OpenSSL version. This commit fixes the compiler errors.

danbev force-pushed the crypto_dynlink_fips branch from e0229a2 to 8856979 Compare January 16, 2019 11:26

danbev closed this Jan 17, 2019

danbev deleted the crypto_dynlink_fips branch January 17, 2019 04:32

MylesBorins mentioned this pull request Jan 24, 2019

v11.8.0 proposal #25687

Merged

richardlau mentioned this pull request May 1, 2020

Compiling node with FIPS nodejs/help#2666

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build: introduce --openssl-is-fips flag #25412

build: introduce --openssl-is-fips flag #25412

danbev commented Jan 9, 2019 •

edited

Loading

nodejs-github-bot commented Jan 9, 2019

mhdawson commented Jan 9, 2019

sam-github commented Jan 9, 2019

danbev commented Jan 9, 2019

danbev commented Jan 11, 2019

danbev commented Jan 14, 2019

addaleax commented Jan 14, 2019

danbev commented Jan 15, 2019

danbev commented Jan 16, 2019

danbev commented Jan 17, 2019

danbev commented Jan 17, 2019

build: introduce --openssl-is-fips flag #25412

build: introduce --openssl-is-fips flag #25412

Conversation

danbev commented Jan 9, 2019 • edited Loading

Checklist

nodejs-github-bot commented Jan 9, 2019

mhdawson commented Jan 9, 2019

sam-github commented Jan 9, 2019

danbev commented Jan 9, 2019

danbev commented Jan 11, 2019

danbev commented Jan 14, 2019

addaleax commented Jan 14, 2019

danbev commented Jan 15, 2019

danbev commented Jan 16, 2019

danbev commented Jan 17, 2019

danbev commented Jan 17, 2019

danbev commented Jan 9, 2019 •

edited

Loading