diff --git a/configure b/configure index 9c8343428e3..24570287ecc 100755 --- a/configure +++ b/configure @@ -152,6 +152,11 @@ parser.add_option('--shared-openssl-libpath', dest='shared_openssl_libpath', help='a directory to search for the shared OpenSSL DLLs') +parser.add_option('--shared-openssl-fips', + action='store_true', + dest='shared_openssl_fips', + help='enable FIPS mode for shared OpenSSL DLLs') + parser.add_option('--shared-v8', action='store_true', dest='shared_v8', @@ -610,6 +615,9 @@ def configure_openssl(o): else: o['cflags'] += cflags.split() + if options.shared_openssl_fips: + o['defines'] += ['OPENSSL_FIPS'] + def configure_winsdk(o): if flavor != 'win': diff --git a/src/node.cc b/src/node.cc index 696a9427498..4f345a0ffda 100644 --- a/src/node.cc +++ b/src/node.cc @@ -33,6 +33,9 @@ #if HAVE_OPENSSL #include "node_crypto.h" +#ifdef OPENSSL_FIPS +#include "crypto.h" +#endif #endif #if defined HAVE_DTRACE || defined HAVE_ETW || defined HAVE_SYSTEMTAP @@ -2420,6 +2423,14 @@ void SetupProcessObject(Environment* env, versions, "openssl", OneByteString(node_isolate, &OPENSSL_VERSION_TEXT[i], j - i)); + +#ifdef OPENSSL_FIPS + if(!FIPS_mode_set(1)) { + fprintf(stderr,"OpenSSL shared library does not support FIPS mode"); + exit(1); + } +#endif + #endif // process.arch