Skip to content

Commit

Permalink
build: introduce --openssl-is-fips flag
Browse files Browse the repository at this point in the history
This commit introduces a new configuration flag named
--openssl-is-fips which is intended to be used when linking against
an OpenSSL library that is FIPS compatible.

The motivation for this is that Red Hat Enterprise Linux 8 (RHEL8)
comes with OpenSSL 1.1.1 and includes FIPS support, and we would
like to be able to dynamically link against this version and also have
FIPS features enabled in node, like would be done when statically
linking and using the --openssl-fips flag.

The suggestion here is to introduce a new flag:
$ ./configure --help
...
--openssl-is-fips specifies that the shared OpenSSL version is FIPS
                  compatible

This flag could be used in combination with the shared-openssl flag:
$ ./configure --shared-openssl ---openssl-is-fips

This will enable FIPS support in node and the runtime flags will be
availalbe to enable FIPS (--enable-fips, --force-fips).

PR-URL: #25412
Reviewed-By: Sam Roberts <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
  • Loading branch information
danbev authored and addaleax committed Jan 23, 2019
1 parent 0897504 commit 47d040d
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 1 deletion.
6 changes: 6 additions & 0 deletions configure.py
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,11 @@
dest='openssl_fips',
help='Build OpenSSL using FIPS canister .o file in supplied folder')

parser.add_option('--openssl-is-fips',
action='store_true',
dest='openssl_is_fips',
help='specifies that the OpenSSL library is FIPS compatible')

parser.add_option('--openssl-use-def-ca-store',
action='store_true',
dest='use_openssl_ca_store',
Expand Down Expand Up @@ -1190,6 +1195,7 @@ def configure_openssl(o):
variables = o['variables']
variables['node_use_openssl'] = b(not options.without_ssl)
variables['node_shared_openssl'] = b(options.shared_openssl)
variables['openssl_is_fips'] = b(options.openssl_is_fips)
variables['openssl_fips'] = ''

if options.openssl_no_asm:
Expand Down
2 changes: 1 addition & 1 deletion node.gypi
Original file line number Diff line number Diff line change
Expand Up @@ -319,7 +319,7 @@
[ 'node_use_openssl=="true"', {
'defines': [ 'HAVE_OPENSSL=1' ],
'conditions': [
['openssl_fips != ""', {
['openssl_fips != "" or openssl_is_fips=="true"', {
'defines': [ 'NODE_FIPS_MODE' ],
}],
[ 'node_shared_openssl=="false"', {
Expand Down

0 comments on commit 47d040d

Please sign in to comment.