diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js index 2b87937fe705d4..a83170c49ae4b1 100644 --- a/test/parallel/test-crypto-fips.js +++ b/test/parallel/test-crypto-fips.js @@ -21,6 +21,10 @@ function compiledWithFips() { return process.config.variables.openssl_fips ? true : false; } +function sharedOpenSSL() { + return process.config.variables.node_shared_openssl; +} + function addToEnv(newVar, value) { const envCopy = {}; for (const e in process.env) { @@ -85,29 +89,43 @@ testHelper( 'require("crypto").fips', process.env); -// OpenSSL config file should be able to turn on FIPS mode -testHelper( - 'stdout', - [`--openssl-config=${CNF_FIPS_ON}`], - compiledWithFips() ? FIPS_ENABLED : FIPS_DISABLED, - 'require("crypto").fips', - process.env); - -// OPENSSL_CONF should be able to turn on FIPS mode -testHelper( - 'stdout', - [], - compiledWithFips() ? FIPS_ENABLED : FIPS_DISABLED, - 'require("crypto").fips', - addToEnv('OPENSSL_CONF', CNF_FIPS_ON)); - -// --openssl-config option should override OPENSSL_CONF -testHelper( - 'stdout', - [`--openssl-config=${CNF_FIPS_ON}`], - compiledWithFips() ? FIPS_ENABLED : FIPS_DISABLED, - 'require("crypto").fips', - addToEnv('OPENSSL_CONF', CNF_FIPS_OFF)); +// If Node was configured using --shared-openssl fips support might be +// available depending on how OpenSSL was built. If fips support is +// available the tests that toggle the fips_mode on/off using the config +// file option will succeed and return 1 instead of 0. +// +// Note that this case is different from when calling the fips setter as the +// configuration file is handled by OpenSSL, so it is not possible for us +// to try to call the fips setter, to try to detect this situation, as +// that would throw an error: +// ("Error: Cannot set FIPS mode in a non-FIPS build."). +// Due to this uncertanty the following tests are skipped when configured +// with --shared-openssl. +if (!sharedOpenSSL()) { + // OpenSSL config file should be able to turn on FIPS mode + testHelper( + 'stdout', + [`--openssl-config=${CNF_FIPS_ON}`], + compiledWithFips() ? FIPS_ENABLED : FIPS_DISABLED, + 'require("crypto").fips', + process.env); + + // OPENSSL_CONF should be able to turn on FIPS mode + testHelper( + 'stdout', + [], + compiledWithFips() ? FIPS_ENABLED : FIPS_DISABLED, + 'require("crypto").fips', + addToEnv('OPENSSL_CONF', CNF_FIPS_ON)); + + // --openssl-config option should override OPENSSL_CONF + testHelper( + 'stdout', + [`--openssl-config=${CNF_FIPS_ON}`], + compiledWithFips() ? FIPS_ENABLED : FIPS_DISABLED, + 'require("crypto").fips', + addToEnv('OPENSSL_CONF', CNF_FIPS_OFF)); +} testHelper( 'stdout',