build: introduce --openssl-is-fips flag

[danbev]

This commit introduces a new configuration flag named
--openssl-is-fips which is intended to be used when linking against
an OpenSSL library that is FIPS compatible.

The motivation for this is that Red Hat Enterprise Linux 8 (RHEL8)
comes with OpenSSL 1.1.1 and includes FIPS support, and we would
like to be able to dynamically link against this version and also have
FIPS features enabled in node, like would be done when statically
linking and using the --openssl-fips flag.

The suggestion here is to introduce a new flag:

$ ./configure --help
...
--openssl-is-fips specifies that the shared OpenSSL library is FIPS
                  compatible

This flag could be used in combination with the --shared-openssl flag:

$ ./configure --shared-openssl --openssl-is-fips

This will enable FIPS support in node and the runtime flags will be
availalbe to enable FIPS (--enable-fips, --force-fips).

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• commit message follows commit guidelines

[nodejs-github-bot]

@danbev build started: https://ci.nodejs.org/blue/organizations/jenkins/node-test-pull-request-lite-pipeline/detail/node-test-pull-request-lite-pipeline/2198/pipeline

[mhdawson]

Do you have any more details on the FIPs certification that RedHat got for OpenSSL 1.1.1 that you can share?

[sam-github]

@danbev sorry to bike-shed on the config name, but I was a bit confused by why it had to exist until I read the configure code.

The problem is that we only specify FIPS build flags ATM when linking against a FIPS canister (--openssl-fips=canister.o).

Can we call the new flag --openssl-is-fips, and describe it as "specifies that the OpenSSL library is FIPS compatible"? This would sort it right next to --openssl-fips in the help output (I wish it had been called --openssl-fips-container=), and not in the shared section, where the flags all have a very nice predictable form and meaning ATM:

    --shared-cares      link to a shared cares DLL instead of static linking
    --shared-cares-includes=SHARED_LIBCARES_INCLUDES
    --shared-cares-libname=SHARED_LIBCARES_LIBNAME
    --shared-cares-libpath=SHARED_LIBCARES_LIBPATH
... etc for all the deps where shared is supported

[danbev]

Do you have any more details on the FIPs certification that RedHat got for OpenSSL 1.1.1 that you can share?

I'll try to find some information about this that I can share.

@sam-github I like the suggestion. I'll follow up on this on Friday (I'm not working tomorrow). Thanks

[danbev]

CI: https://ci.nodejs.org/job/node-test-pull-request/20058/

[danbev]

Re-run of failing node-test-commit-windows-fanned
Re-run of failing node-test-commit-arm-fanned

[addaleax]

CI: https://ci.nodejs.org/job/node-test-pull-request/20114/

[danbev]

Re-run of failing node-test-commit-arm

[danbev]

Re-based CI: https://ci.nodejs.org/job/node-test-pull-request/20164/

[danbev]

Re-run of failing node-test-commit-arm-fanned ✔️

[danbev]

Landed in 7e7266a, and 228a3f8.