src: fix FIPS init error handling#58379
Merged
nodejs-github-bot merged 1 commit intonodejs:mainfrom May 30, 2025
Merged
Conversation
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
If
--enable-fipsor--force-fipsfails to be applied duringProcessFipsOptions(), the node process might exit withExitCode::kNoFailurebecauseERR_GET_REASON(ERR_peek_error())can return0sincencrypto::testFipsEnabled()does not populate the OpenSSL error queue.This is problematic because an exit code of
0(i.e.,kNoFailure) indicates successful execution of thenodecommand, even though it already failed during initialization. (Error messages also appear to be broken, but fixing that is not as urgent as not pretending that the command succeeded.)For example, if a user invokes
nodefrom within a bash script andNODE_OPTIONSincludes--force-fips, the execution of the command will appear to have succeeded even if the actual user script was never executed due to a configuration error.You can likely test this locally by running
with the current
nodebinary from the main branch if compiled without support for FIPS.As confirmed by the
XXXcomment here, which was added three years ago in commit b697160, even if the error queue was populated properly, the OpenSSL reason codes are not really related to the Node.jsExitCodeenumeration.This commit changes the initialization logic to exit with
kGenericUserErrorin this case, since such errors are most likely due to incorrect configuration. It also modifies the existing test case to actually check the exit code of the process, which would have prevented this recent regression.Considering that the current behavior is incorrect, I'd prefer to merge this as a bugfix rather than a semver-major change.