Commit ee9ae886363 for nodejs
commit ee9ae8863631ee24a3dd6ecf66cf6d99c265d582
Author: Filip Skokan <panva.ip@gmail.com>
Date: Mon Jul 27 01:13:01 2026 +0200
test,tools: drop OpenSSL 1.x-era FIPS leftovers
The openssl_fips_*.cnf fixtures use OpenSSL 1.x syntax, and their test
branches can no longer run. Remove the fixtures and related version
gates while keeping the provider-backed FIPS assertions.
get_env_type() sniffed for a "-fips" version suffix that can no longer
occur, and the crypto-check lint rule listed a helper that no longer
exists.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
diff --git a/test/fixtures/openssl_fips_disabled.cnf b/test/fixtures/openssl_fips_disabled.cnf
deleted file mode 100644
index 253c6906e3f..00000000000
--- a/test/fixtures/openssl_fips_disabled.cnf
+++ /dev/null
@@ -1,12 +0,0 @@
-# Skeleton openssl.cnf for testing with FIPS
-
-nodejs_conf = openssl_conf_section
-authorityKeyIdentifier=keyid:always,issuer:always
-
-[openssl_conf_section]
- # Configuration module list
-alg_section = evp_sect
-
-[ evp_sect ]
-# Set to "yes" to enter FIPS mode if supported
-fips_mode = no
diff --git a/test/fixtures/openssl_fips_enabled.cnf b/test/fixtures/openssl_fips_enabled.cnf
deleted file mode 100644
index 79733c657a9..00000000000
--- a/test/fixtures/openssl_fips_enabled.cnf
+++ /dev/null
@@ -1,12 +0,0 @@
-# Skeleton openssl.cnf for testing with FIPS
-
-nodejs_conf = openssl_conf_section
-authorityKeyIdentifier=keyid:always,issuer:always
-
-[openssl_conf_section]
- # Configuration module list
-alg_section = evp_sect
-
-[ evp_sect ]
-# Set to "yes" to enter FIPS mode if supported
-fips_mode = yes
diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js
index ad67ec181c7..2ff8e2325b3 100644
--- a/test/parallel/test-crypto-fips.js
+++ b/test/parallel/test-crypto-fips.js
@@ -4,7 +4,7 @@ const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
-const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
if (isBoringSSL)
common.skip('BoringSSL does not support FIPS');
@@ -13,27 +13,15 @@ const assert = require('assert');
const spawnSync = require('child_process').spawnSync;
const path = require('path');
const { spawnSyncAndAssert } = require('../common/child_process');
-const fixtures = require('../common/fixtures');
const { internalBinding } = require('internal/test/binding');
const { testFipsCrypto } = internalBinding('crypto');
const FIPS_ENABLED = 1;
const FIPS_DISABLED = 0;
-const FIPS_ERROR_STRING2 =
- 'Error [ERR_CRYPTO_FIPS_FORCED]: Cannot set FIPS mode, it was forced with ' +
- '--force-fips at startup.';
-const FIPS_UNSUPPORTED_ERROR_STRING = 'fips mode not supported';
const FIPS_ENABLE_ERROR_STRING =
- hasOpenSSL(3) ?
- '--enable-fips requires an active OpenSSL provider named "fips"' :
- 'OpenSSL error when trying to enable FIPS:';
+ '--enable-fips requires an active OpenSSL provider named "fips"';
const FIPS_FORCE_ERROR_STRING =
- hasOpenSSL(3) ?
- '--force-fips requires an active OpenSSL provider named "fips"' :
- 'OpenSSL error when trying to enable FIPS:';
-
-const CNF_FIPS_ON = fixtures.path('openssl_fips_enabled.cnf');
-const CNF_FIPS_OFF = fixtures.path('openssl_fips_disabled.cnf');
+ '--force-fips requires an active OpenSSL provider named "fips"';
const kNoFailure = 0;
const kGenericUserError = 1;
@@ -147,23 +135,21 @@ if (!sharedOpenSSL()) {
'require("crypto").getFips()',
{ ...process.env, 'OPENSSL_CONF': ' ' });
- if (hasOpenSSL(3)) {
- // Disabling FIPS mode should not throw after OpenSSL updates the default
- // property query.
- testHelper(
- 'stdout',
- [],
- kNoFailure,
- FIPS_DISABLED,
- '(() => {' +
- 'const crypto = require("crypto");' +
- 'crypto.setFips(true);' +
- 'require("assert").strictEqual(crypto.getFips(), 1);' +
- 'crypto.setFips(false);' +
- 'return crypto.getFips();' +
- '})()',
- { ...process.env, 'OPENSSL_CONF': ' ' });
- }
+ // Disabling FIPS mode should not throw after OpenSSL updates the default
+ // property query.
+ testHelper(
+ 'stdout',
+ [],
+ kNoFailure,
+ FIPS_DISABLED,
+ '(() => {' +
+ 'const crypto = require("crypto");' +
+ 'crypto.setFips(true);' +
+ 'require("assert").strictEqual(crypto.getFips(), 1);' +
+ 'crypto.setFips(false);' +
+ 'return crypto.getFips();' +
+ '})()',
+ { ...process.env, 'OPENSSL_CONF': ' ' });
}
// Toggling fips with setFips should not be allowed from a worker thread
@@ -175,202 +161,6 @@ testHelper(
'new worker_threads.Worker(\'require("crypto").setFips(true);\', { eval: true })',
process.env);
-// This should succeed for both FIPS and non-FIPS builds in combination with
-// OpenSSL 1.1.1 or OpenSSL 3.0
+// This should succeed whether FIPS is enabled or disabled.
const test_result = testFipsCrypto();
assert.ok(test_result === 1 || test_result === 0);
-
-// If Node was configured using --shared-openssl fips support might be
-// available depending on how OpenSSL was built. If fips support is
-// available the tests that toggle the fips_mode on/off using the config
-// file option will succeed and return 1 instead of 0.
-//
-// Note that this case is different from when calling the fips setter as the
-// configuration file is handled by OpenSSL, so it is not possible for us
-// to try to call the fips setter, to try to detect this situation, as
-// that would throw an error:
-// ("Error: Cannot set FIPS mode in a non-FIPS build.").
-// Due to this uncertainty the following tests are skipped when configured
-// with --shared-openssl.
-if (!sharedOpenSSL() && !hasOpenSSL(3)) {
- // OpenSSL config file should be able to turn on FIPS mode
- testHelper(
- 'stdout',
- [`--openssl-config=${CNF_FIPS_ON}`],
- kNoFailure,
- testFipsCrypto() ? FIPS_ENABLED : FIPS_DISABLED,
- 'require("crypto").getFips()',
- process.env);
-
- // OPENSSL_CONF should be able to turn on FIPS mode
- testHelper(
- 'stdout',
- [],
- kNoFailure,
- testFipsCrypto() ? FIPS_ENABLED : FIPS_DISABLED,
- 'require("crypto").getFips()',
- Object.assign({}, process.env, { 'OPENSSL_CONF': CNF_FIPS_ON }));
-
- // --openssl-config option should override OPENSSL_CONF
- testHelper(
- 'stdout',
- [`--openssl-config=${CNF_FIPS_ON}`],
- kNoFailure,
- testFipsCrypto() ? FIPS_ENABLED : FIPS_DISABLED,
- 'require("crypto").getFips()',
- Object.assign({}, process.env, { 'OPENSSL_CONF': CNF_FIPS_OFF }));
-}
-
-// OpenSSL 3.x has changed the configuration files so the following tests
-// will not work as expected with that version.
-// TODO(danbev) Revisit these test once FIPS support is available in
-// OpenSSL 3.x.
-if (!hasOpenSSL(3)) {
- testHelper(
- 'stdout',
- [`--openssl-config=${CNF_FIPS_OFF}`],
- kNoFailure,
- FIPS_DISABLED,
- 'require("crypto").getFips()',
- Object.assign({}, process.env, { 'OPENSSL_CONF': CNF_FIPS_ON }));
-
- // --enable-fips should take precedence over OpenSSL config file
- testHelper(
- testFipsCrypto() ? 'stdout' : 'stderr',
- ['--enable-fips', `--openssl-config=${CNF_FIPS_OFF}`],
- testFipsCrypto() ? kNoFailure : kGenericUserError,
- testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
- 'require("crypto").getFips()',
- process.env);
- // --force-fips should take precedence over OpenSSL config file
- testHelper(
- testFipsCrypto() ? 'stdout' : 'stderr',
- ['--force-fips', `--openssl-config=${CNF_FIPS_OFF}`],
- testFipsCrypto() ? kNoFailure : kGenericUserError,
- testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
- 'require("crypto").getFips()',
- process.env);
- // --enable-fips should turn FIPS mode on
- testHelper(
- testFipsCrypto() ? 'stdout' : 'stderr',
- ['--enable-fips'],
- testFipsCrypto() ? kNoFailure : kGenericUserError,
- testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
- 'require("crypto").getFips()',
- process.env);
-
- // --force-fips should turn FIPS mode on
- testHelper(
- testFipsCrypto() ? 'stdout' : 'stderr',
- ['--force-fips'],
- testFipsCrypto() ? kNoFailure : kGenericUserError,
- testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
- 'require("crypto").getFips()',
- process.env);
-
- // OPENSSL_CONF should _not_ make a difference to --enable-fips
- testHelper(
- testFipsCrypto() ? 'stdout' : 'stderr',
- ['--enable-fips'],
- testFipsCrypto() ? kNoFailure : kGenericUserError,
- testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
- 'require("crypto").getFips()',
- Object.assign({}, process.env, { 'OPENSSL_CONF': CNF_FIPS_OFF }));
-
- // Using OPENSSL_CONF should not make a difference to --force-fips
- testHelper(
- testFipsCrypto() ? 'stdout' : 'stderr',
- ['--force-fips'],
- testFipsCrypto() ? kNoFailure : kGenericUserError,
- testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
- 'require("crypto").getFips()',
- Object.assign({}, process.env, { 'OPENSSL_CONF': CNF_FIPS_OFF }));
-
- // setFipsCrypto should be able to turn FIPS mode on
- testHelper(
- testFipsCrypto() ? 'stdout' : 'stderr',
- [],
- testFipsCrypto() ? kNoFailure : kGenericUserError,
- testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
- '(require("crypto").setFips(true),' +
- 'require("crypto").getFips())',
- process.env);
-
- // setFipsCrypto should be able to turn FIPS mode on and off
- testHelper(
- testFipsCrypto() ? 'stdout' : 'stderr',
- [],
- testFipsCrypto() ? kNoFailure : kGenericUserError,
- testFipsCrypto() ? FIPS_DISABLED : FIPS_UNSUPPORTED_ERROR_STRING,
- '(require("crypto").setFips(true),' +
- 'require("crypto").setFips(false),' +
- 'require("crypto").getFips())',
- process.env);
-
- // setFipsCrypto takes precedence over OpenSSL config file, FIPS on
- testHelper(
- testFipsCrypto() ? 'stdout' : 'stderr',
- [`--openssl-config=${CNF_FIPS_OFF}`],
- testFipsCrypto() ? kNoFailure : kGenericUserError,
- testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
- '(require("crypto").setFips(true),' +
- 'require("crypto").getFips())',
- process.env);
-
- // setFipsCrypto takes precedence over OpenSSL config file, FIPS off
- testHelper(
- 'stdout',
- [`--openssl-config=${CNF_FIPS_ON}`],
- kNoFailure,
- FIPS_DISABLED,
- '(require("crypto").setFips(false),' +
- 'require("crypto").getFips())',
- process.env);
-
- // --enable-fips does not prevent use of setFipsCrypto API
- testHelper(
- testFipsCrypto() ? 'stdout' : 'stderr',
- ['--enable-fips'],
- testFipsCrypto() ? kNoFailure : kGenericUserError,
- testFipsCrypto() ? FIPS_DISABLED : FIPS_UNSUPPORTED_ERROR_STRING,
- '(require("crypto").setFips(false),' +
- 'require("crypto").getFips())',
- process.env);
-
- // --force-fips prevents use of setFipsCrypto API
- testHelper(
- 'stderr',
- ['--force-fips'],
- kGenericUserError,
- testFipsCrypto() ? FIPS_ERROR_STRING2 : FIPS_UNSUPPORTED_ERROR_STRING,
- 'require("crypto").setFips(false)',
- process.env);
-
- // --force-fips makes setFipsCrypto enable a no-op (FIPS stays on)
- testHelper(
- testFipsCrypto() ? 'stdout' : 'stderr',
- ['--force-fips'],
- testFipsCrypto() ? kNoFailure : kGenericUserError,
- testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
- '(require("crypto").setFips(true),' +
- 'require("crypto").getFips())',
- process.env);
-
- // --force-fips and --enable-fips order does not matter
- testHelper(
- 'stderr',
- ['--force-fips', '--enable-fips'],
- kGenericUserError,
- testFipsCrypto() ? FIPS_ERROR_STRING2 : FIPS_UNSUPPORTED_ERROR_STRING,
- 'require("crypto").setFips(false)',
- process.env);
-
- // --enable-fips and --force-fips order does not matter
- testHelper(
- 'stderr',
- ['--enable-fips', '--force-fips'],
- kGenericUserError,
- testFipsCrypto() ? FIPS_ERROR_STRING2 : FIPS_UNSUPPORTED_ERROR_STRING,
- 'require("crypto").setFips(false)',
- process.env);
-}
diff --git a/test/parallel/test-dsa-fips-invalid-key.js b/test/parallel/test-dsa-fips-invalid-key.js
index 3df51bfbed3..43ac7e22ced 100644
--- a/test/parallel/test-dsa-fips-invalid-key.js
+++ b/test/parallel/test-dsa-fips-invalid-key.js
@@ -9,7 +9,7 @@ const fixtures = require('../common/fixtures');
const crypto = require('crypto');
if (!crypto.getFips()) {
- common.skip('node compiled without FIPS OpenSSL.');
+ common.skip('OpenSSL is not configured for FIPS mode');
}
const assert = require('assert');
diff --git a/tools/eslint-rules/crypto-check.js b/tools/eslint-rules/crypto-check.js
index 10862c1b160..bd79303829b 100644
--- a/tools/eslint-rules/crypto-check.js
+++ b/tools/eslint-rules/crypto-check.js
@@ -48,7 +48,7 @@ module.exports = {
}
function isCryptoCheck(node) {
- return utils.usesCommonProperty(node, ['hasCrypto', 'hasFipsCrypto']);
+ return utils.usesCommonProperty(node, ['hasCrypto']);
}
function checkCryptoCall(node) {
diff --git a/tools/test.py b/tools/test.py
index 58217f1d11c..31df6ec1ebe 100755
--- a/tools/test.py
+++ b/tools/test.py
@@ -1469,7 +1469,7 @@ def BuildOptions():
help='Send SIGABRT instead of SIGTERM to kill processes that time out',
default=False, action="store_true", dest="abort_on_timeout")
result.add_argument("--type",
- help="Type of build (simple, fips, coverage)",
+ help="Type of build (simple, coverage)",
default=None)
result.add_argument("--error-reporter",
help="use error reporter if the test uses node:test",
@@ -1633,14 +1633,9 @@ def ArgsToTestPaths(test_root, args, suites):
def get_env_type(vm, options_type, context):
if options_type is not None:
- env_type = options_type
- else:
- # 'simple' is the default value for 'env_type'.
- env_type = 'simple'
- ssl_ver = Execute([vm, '-p', 'process.versions.openssl'], context).stdout
- if 'fips' in ssl_ver:
- env_type = 'fips'
- return env_type
+ return options_type
+ # 'simple' is the default value for 'env_type'.
+ return 'simple'
def get_asan_state(vm, context):