Repository navigation
Compiling node with FIPS #2666
Description
- Node.js Version: 12.x
- OS: Ubuntu 18.04.04-FIPS
- Scope (install, code, runtime, meta, other?): compile
- Module (and version) (if relevant):OpenSSL 1.1.1
I'm attempting to compile node (12.x) on Ubuntu 18 with the recently certified OpenSSL module and when running ./configure --openssl-fips=/usr/include/openssl, I get the immediate error message
ERROR: FIPS is not supported in this version of Node.js
From #753 I was under the impression that compilation is possible if I had the FIPS libraries installed on a FIPS enabled kernel (which Bionic now is, as of 4/29/20). Am I sadly mistaken? Maybe moving to a later version of node would help? I used git clone -b v12.x..., which I presume is 12.16.3
Can someone give me some guidance please?
Activity
addaleax commentedon May 1, 2020
@nodejs/crypto
D4V3M0NK commentedon May 1, 2020
D4V3M0NK commentedon May 1, 2020
I've read the OpenSSL strategy document and noted that only node v6 and v8 are currently FIPS compatible (with openssl 1.0.2) so I tried Ubuntu 16 (with OpenSSL FIPS enabled) and attempted to build v8 but that fails too (
fipsld not found) ...Any thoughts or pointers would be appreciated.
richardlau commentedon May 1, 2020
By default Node.js will statically compile and use the version of OpenSSL in
deps/openssl. You probably want to be using--shared-opensslto link to your system OpenSSL and possibly also--openssl-is-fipsbased on nodejs/build#2176.You're running into nodejs/node#30189.
D4V3M0NK commentedon May 1, 2020
@richardlau thank you sir, that's great information right there.
So, I've gone ahead and just used
./configure --shared-openssl --openssl-is-fipswhich didn't throw any errors. Unfortunately, when I then usedmake -j4I get:Forgive me, I'm not a programmer and not sure where I should go from here...
richardlau commentedon May 1, 2020
Sorry, I don't know why the compiler appears to have crashed. We use g++ 6.3 in our CI, so your version of g++ should be compatible.
sam-github commentedon May 1, 2020
I usually see compilers crashing due to lack of memory, I'd give that a check.
D4V3M0NK commentedon May 1, 2020
@sam-github Thanks Sam, I bumped up my VM to 4GB and the crashing has been resolved!
I also read #30189 (thank you @richardlau) and have installed python3-distutils ... but now running into this issue ...
I'm trying to work out if this is a V8 issue or an OpenSSL configuration issue?
sam-github commentedon May 1, 2020
https://github.com/nodejs/TSC/blob/master/OpenSSL-Strategy.md
fips isn't supported for node 10 and later.
see https://wiki.openssl.org/index.php/FIPS_module_2.0
Maybe if you build that, then build node 12 against it, it might work but I don't expect so. I've never done it, and its not supported, but YMMV.
Your compile above failed because whatever you are building against doesn't have an openssl 1.1.1 compatible API, I'm not sure why.
D4V3M0NK commentedon May 1, 2020
From what I can see, I'm wondering if
shared-openssl-includesshould be set, referring to the folder that contains the openssl conf.h file? Would that make sense?Um ... 30mins later ... nope, it wasn't that...
@sam-github : thanks for your continued responses - perhaps I'll try node 8 and see how well that works ...
sam-github commentedon May 1, 2020
It at least was supported on Node.js 8. Not that Node.js or openssl of that vintage is supported, but the feature at least existed.
D4V3M0NK commentedon May 1, 2020
Ok, so cloning v8.x compiled with
--shared-openssl --shared-openssl-includes=successfully compiles!! After following up withmake installandnode -vI get 8.17.1-pre. This is a significant move forward.The last thing I need to understand is why "make -j4 binary" (as was mentioned in #753) bails out on me... stating that
Am I going to screw anything up if I change node_version.h and set
#define NODE_VERSION_IS_RELEASEfrom 0 to 1 in order to get a binary, so that I can use that binary on another (like) system?bnoordhuis commentedon May 3, 2020
Should be fine. The only thing it controls is whether
process.versionincludes-pre(for prerelease) in the string.D4V3M0NK commentedon May 4, 2020
I'm going to close this issue as of right now - thank you for all your help @richardlau and @sam-github for pointers in the right direction. I'm going to post the commands I used to get this going (binary works too):
$ uname -rshows "fips" as does$ openssl versiongit clone -b v8.x https://github.com/nodejs/node.gitcd node./configure --shared-openssl --shared-openssl-includes=/usr/include/opensslmake -j4 binarymake -j4make -j4 installD4V3M0NK commentedon May 4, 2020
Ah ... jumped a little too early I think. So I've compiled to a binary and then moved this onto another identical system. Expanded the binaries out (as per the wiki) and whilst everything looks just fine, when I run
npm versionI get a rather interesting response when it comes to openssl:{ npm: '6.13.4',
ares: '1.10.1-DEV',
cldr: '32.0',
http_parser: '2.8.0',
icu: '60.1',
modules: '57',
napi: '4',
nghttp2: '1.39.2',
node: '8.17.1',
openssl: '1.0.2s',
tz: '2017c',
unicode: '10.0',
uv: '1.23.2',
v8: '6.2.414.78',
zlib: '1.2.11' }
That OpenSSL version should read, IMHO, 1.0.2g should it not - the same version that my system has, the same version of the certified FIPS Crypto Module?!
richardlau commentedon May 4, 2020
@D4V3M0NK If you run
make binarythe Makefile rerunsconfigure: https://github.com/nodejs/node/blob/39ff64756bd5bc7147236b36ee9444ceddb3e6d2/Makefile#L1167-L1172You can pass in extra flags via the
CONFIG_FLAGSMakefile variable.D4V3M0NK commentedon May 4, 2020
@richardlau ... oh that's mighty good to know! Will let you know how I get on...
D4V3M0NK commentedon May 5, 2020
@richardlau : you sir, are a gentleman and a scholar - that was the last piece of the puzzle! OpenSSL 1.0.2g-fips listed in
npm version! I can't put down in words just how efficient everyone has been in assisting me in this process. I can't thank you all enough...For historical purposes, I shall place the final build solution as below:
$ uname -rshows "fips" as does$ openssl versiongit clone -b v8.x https://github.com/nodejs/node.gitcd node./configure --shared-openssl --shared-openssl-includes=/usr/include/opensslCONFIG_FLAGS=--shared-openssl --shared-openssl-includes=/usr/include/openssl make -j4 binarymake -j4make -j4 installf33losopher commentedon May 18, 2021
@D4V3M0NK when you do uname -r, where do you see FIPS? Is it kernel-name, nodename, etc...
D4V3M0NK commentedon May 18, 2021
kernel-name and openssl version
hoanghua commentedon Dec 19, 2021
@D4V3M0NK thank you for the summary of the steps. I've followed the same step and can make it built successfully with Node 8. However, as Node 8 is already end of support in 2020. I'm trying to build with Node 16; however, I faced with a similar error you've posted above
../src/crypto/crypto_util.cc: In function ‘void node::crypto::InitCryptoOnce()’: ../src/crypto/crypto_util.cc:135:5: error: ‘OPENSSL_INIT_set_config_filename’ was not declared in this scope OPENSSL_INIT_set_config_filename(settings, conf); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../src/crypto/crypto_util.cc:135:5: note: suggested alternative: ‘OPENSSL_INIT_set_config_appname’ OPENSSL_INIT_set_config_filename(settings, conf); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ OPENSSL_INIT_set_config_appname In file included from ../src/crypto/crypto_util.h:19:0, from ../src/crypto/crypto_keys.h:6, from ../src/crypto/crypto_cipher.h:6, from ../src/crypto/crypto_rsa.h:6, from ../src/crypto/crypto_rsa.cc:1: ../src/crypto/crypto_rsa.cc: In static member function ‘static node::crypto::EVPKeyCtxPointer node::crypto::RsaKeyGenTraits::Setup(node::crypto::RsaKeyPairGenConfig*)’: ../src/crypto/crypto_rsa.cc:62:9: error: ‘EVP_PKEY_OP_TYPE_KEYGEN’ was not declared in this scope EVP_PKEY_CTX_set_rsa_pss_keygen_md(ctx.get(), params->params.md) <= 0) { ^ ../src/crypto/crypto_rsa.cc:62:9: note: suggested alternative: ‘EVP_PKEY_OP_TYPE_NOGEN’ ../src/crypto/crypto_rsa.cc: In function ‘v8::Maybe<bool> node::crypto::GetRsaKeyDetail(node::Environment*, std::shared_ptr<node::crypto::KeyObjectData>, v8::Local<v8::Object>)’: ../src/crypto/crypto_rsa.cc:583:36: error: ‘RSA_get0_pss_params’ was not declared in this scope const RSA_PSS_PARAMS* params = RSA_get0_pss_params(rsa); ^~~~~~~~~~~~~~~~~~~ ../src/crypto/crypto_rsa.cc:583:36: note: suggested alternative: ‘RSA_get0_crt_params’ const RSA_PSS_PARAMS* params = RSA_get0_pss_params(rsa); ^~~~~~~~~~~~~~~~~~~ RSA_get0_crt_params libnode.target.mk:372: recipe for target '/home/ubuntu/hoang/node-v16.13.0/out/Release/obj.target/libnode/src/crypto/crypto_util.o' failed make[1]: *** [/home/ubuntu/hoang/node-v16.13.0/out/Release/obj.target/libnode/src/crypto/crypto_util.o] Error 1 make[1]: *** Waiting for unfinished jobs.... libnode.target.mk:372: recipe for target '/home/ubuntu/hoang/node-v16.13.0/out/Release/obj.target/libnode/src/crypto/crypto_rsa.o' failed make[1]: *** [/home/ubuntu/hoang/node-v16.13.0/out/Release/obj.target/libnode/src/crypto/crypto_rsa.o] Error 1 rm 58f0bb9d673dc8524358464081636a66d0200c83.intermediate 45cfe825109e2d0b854e6101f9e73c16f3f88057.intermediate Makefile:110: recipe for target 'node' failed make: *** [node] Error 2May I ask if you've been able to pass this error in the past? Or you have to switch to Node 8 to overcome that?
D4V3M0NK commentedon Dec 19, 2021
Until the newer version of OpenSSL (FIPS) is released, I had to resort to sticking with Node8 as that was the last version that worked with OpenSSL.