Skip to content

Commit 9eeaab4

Browse files
gibfahnMylesBorins
authored andcommitted
crypto: only try to set FIPS mode if different
Turning FIPS mode on (or off) when it's already on (or off) should be a no-op, not an error. PR-URL: #12210 Fixes: #11849 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]> Reviewed-By: James M Snell <[email protected]>
1 parent 34b4180 commit 9eeaab4

File tree

2 files changed

+14
-2
lines changed

2 files changed

+14
-2
lines changed

src/node_crypto.cc

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6060,11 +6060,14 @@ void GetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
60606060
void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
60616061
Environment* env = Environment::GetCurrent(args);
60626062
#ifdef NODE_FIPS_MODE
6063-
bool mode = args[0]->BooleanValue();
6063+
const bool enabled = FIPS_mode();
6064+
const bool enable = args[0]->BooleanValue();
6065+
if (enable == enabled)
6066+
return; // No action needed.
60646067
if (force_fips_crypto) {
60656068
return env->ThrowError(
60666069
"Cannot set FIPS mode, it was forced with --force-fips at startup.");
6067-
} else if (!FIPS_mode_set(mode)) {
6070+
} else if (!FIPS_mode_set(enable)) {
60686071
unsigned long err = ERR_get_error(); // NOLINT(runtime/int)
60696072
return ThrowCryptoError(env, err);
60706073
}

test/parallel/test-crypto-fips.js

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,15 @@ testHelper(
212212
'require("crypto").fips = false',
213213
process.env);
214214

215+
// --force-fips makes setFipsCrypto enable a no-op (FIPS stays on)
216+
testHelper(
217+
compiledWithFips() ? 'stdout' : 'stderr',
218+
['--force-fips'],
219+
compiledWithFips() ? FIPS_ENABLED : OPTION_ERROR_STRING,
220+
'(require("crypto").fips = true,' +
221+
'require("crypto").fips)',
222+
process.env);
223+
215224
// --force-fips and --enable-fips order does not matter
216225
testHelper(
217226
'stderr',

0 commit comments

Comments
 (0)