{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/3820","labels_url":"https://api.github.com/repos/nodejs/node/issues/3820/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/3820/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/3820/events","html_url":"https://github.com/nodejs/node/pull/3820","id":116864289,"number":3820,"title":"Add a check of the OPENSSL_FIPS environment variable around each call…","user":{"login":"lordjabez","id":5554910,"avatar_url":"https://avatars.githubusercontent.com/u/5554910?v=3","gravatar_id":"","url":"https://api.github.com/users/lordjabez","html_url":"https://github.com/lordjabez","followers_url":"https://api.github.com/users/lordjabez/followers","following_url":"https://api.github.com/users/lordjabez/following{/other_user}","gists_url":"https://api.github.com/users/lordjabez/gists{/gist_id}","starred_url":"https://api.github.com/users/lordjabez/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lordjabez/subscriptions","organizations_url":"https://api.github.com/users/lordjabez/orgs","repos_url":"https://api.github.com/users/lordjabez/repos","events_url":"https://api.github.com/users/lordjabez/events{/privacy}","received_events_url":"https://api.github.com/users/lordjabez/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodejs/node/labels/crypto","name":"crypto","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-11-13T22:16:29Z","updated_at":"2015-11-14T01:02:38Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/nodejs/node/pulls/3820","html_url":"https://github.com/nodejs/node/pull/3820","diff_url":"https://github.com/nodejs/node/pull/3820.diff","patch_url":"https://github.com/nodejs/node/pull/3820.patch"},"body":"As currently implemented, when Node is compiled with FIPS support\r\n(`./configure fips`), there is no way to disable engaging FIPS mode\r\nduring execution (Issue #3819). This means that several functions that rely on\r\nnon-FIPS approved algorithms (e.g. md5 hashing) will fail, as will\r\nany code that depends on them (most obviously, `npm`).\r\n\r\nWhat seems needed to me is a way to explicitly enable or disable\r\nFIPS operation each time node is invoked. The way this is done\r\nwith the openssl CLI is via the OPENSSL_FIPS environment variable.\r\n\r\nThis change adds a check to OPENSSL_FIPS at every place where\r\nFIPS_mode_set(1) is called (which enables FIPS mode). If Node\r\nis not compiled in FIPS mode these calls will not even be\r\ncompiled since they're all wrapped with IFDEFs.\r\n\r\nThose who are trying to run Node.js in FIPS mode should be\r\nfamiliar with this variable and using it will be natural."},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/156602226","html_url":"https://github.com/nodejs/node/pull/3820#issuecomment-156602226","issue_url":"https://api.github.com/repos/nodejs/node/issues/3820","id":156602226,"user":{"login":"lordjabez","id":5554910,"avatar_url":"https://avatars.githubusercontent.com/u/5554910?v=3","gravatar_id":"","url":"https://api.github.com/users/lordjabez","html_url":"https://github.com/lordjabez","followers_url":"https://api.github.com/users/lordjabez/followers","following_url":"https://api.github.com/users/lordjabez/following{/other_user}","gists_url":"https://api.github.com/users/lordjabez/gists{/gist_id}","starred_url":"https://api.github.com/users/lordjabez/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lordjabez/subscriptions","organizations_url":"https://api.github.com/users/lordjabez/orgs","repos_url":"https://api.github.com/users/lordjabez/repos","events_url":"https://api.github.com/users/lordjabez/events{/privacy}","received_events_url":"https://api.github.com/users/lordjabez/received_events","type":"User","site_admin":false},"created_at":"2015-11-14T01:02:38Z","updated_at":"2015-11-14T01:02:38Z","body":"@indutny On the contrary, the typical behavior of FIPS capable applications is to not activate FIPS mode unless explicitly commanded. For example, this is how the FIPS validated openssl command line utility works. I cribbed the environment variable from the openssl implementation, in fact. So it'd be quite natural for folks who do FIPS to already have that variable set in their operating environments.\r\n\r\nBesides, having FIPS mode active by default at runtime makes using a FIPS capable Node build rather difficult, esp. when it's being used \"under the hood\" by other utilities. This whole issue came up for me because npm wouldn't run due to its use of non-FIPS hashing algorithms. If FIPS is on by default, do I now need to explicitly disable it every time I run npm or any other of a hundred different CLI tools that use FIPS under the hood? That becomes even more painful if this switch is via a switch (vs environment variable) because now I have to hack around on the npm scripts themselves."}}