build: remove the bundled FIPS provider build

--openssl-is-fips with bundled OpenSSL never worked: the
openssl-fipsmodule target had no dependency edge, so fipsinstall's
input was produced by nothing. Repairing it would not help, since a
FIPS provider built out of tree has no validation status.

Remove the machinery and restrict --openssl-is-fips to --shared-openssl.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Author: panva

BUILDING.md

@@ -1042,14 +1042,20 @@ using the following configure option:
 
 ## Building Node.js with FIPS-compliant OpenSSL
 
-Node.js supports FIPS when statically or dynamically linked with OpenSSL 3 via
-[OpenSSL's provider model](https://docs.openssl.org/3.0/man7/crypto/#OPENSSL-PROVIDERS).
-It is not necessary to rebuild Node.js to enable support for FIPS.
+Node.js can use an OpenSSL FIPS provider via
+[OpenSSL's provider model](https://docs.openssl.org/master/man7/crypto/#openssl-providers),
+whether OpenSSL is linked statically or dynamically. It is not necessary to
+rebuild Node.js to do so; the provider and the OpenSSL configuration that
+activates it are supplied at runtime.
 
-When using OpenSSL 1.1.1, Node.js must be built against a FIPS-capable OpenSSL.
+Node.js does not build a FIPS provider. OpenSSL requires that a FIPS provider
+be built from a release that carries a FIPS certificate, so a provider built
+as part of the Node.js build would have no validation status.
 
-See [FIPS mode](doc/api/crypto.md#fips-mode) for more information on how to
-enable FIPS support in Node.js.
+`./configure --openssl-is-fips` only records that the OpenSSL being linked is
+FIPS capable, and requires `--shared-openssl`.
+
+See [FIPS mode](doc/api/crypto.md#fips-mode) for how to configure it.
 
 ## Building Node.js with Temporal support
 

configure.py

@@ -268,7 +268,8 @@
     action='store_true',
     dest='openssl_is_fips',
     default=None,
-    help='specifies that the OpenSSL library is FIPS compatible')
+    help='specifies that the shared OpenSSL library is FIPS capable '
+         '(requires --shared-openssl)')
 
 parser.add_argument('--openssl-use-def-ca-store',
     action='store_true',
@@ -2275,7 +2276,6 @@ def configure_openssl(o):
   variables['node_shared_ngtcp2'] = b(options.shared_ngtcp2)
   variables['node_shared_nghttp3'] = b(options.shared_nghttp3)
   variables['openssl_is_fips'] = b(options.openssl_is_fips)
-  variables['node_fipsinstall'] = b(False)
 
   if options.openssl_no_asm:
     variables['openssl_no_asm'] = 1
@@ -2330,12 +2330,12 @@ def without_ssl_error(option):
   if options.openssl_no_asm and options.shared_openssl:
     error('--openssl-no-asm is incompatible with --shared-openssl')
 
+  if options.openssl_is_fips and not options.shared_openssl:
+    error('--openssl-is-fips is only available with --shared-openssl')
+
   if options.openssl_is_fips:
     o['defines'] += ['OPENSSL_FIPS']
 
-  if options.openssl_is_fips and not options.shared_openssl:
-    variables['node_fipsinstall'] = b(True)
-
   configure_library('openssl', o)
 
   o['variables']['openssl_version'] = get_openssl_version(o)

deps/openssl/openssl.gyp

@@ -97,35 +97,6 @@
           },
         }],
      ]
-    }, {
-      # openssl-fipsmodule target
-      'target_name': 'openssl-fipsmodule',
-      'type': 'shared_library',
-      'dependencies': ['openssl-cli'],
-      'includes': ['./openssl_common.gypi'],
-      'include_dirs+': ['openssl/apps/include'],
-      'cflags': [ '-fPIC' ],
-      #'ldflags': [ '-o', 'fips.so' ],
-      #'ldflags': [ '-Wl,--version-script=providers/fips.ld',],
-      'conditions': [
-        [ 'openssl_no_asm==1', {
-          'includes': ['./openssl-fips_no_asm.gypi'],
-        }, 'target_arch=="arm64" and OS=="win"', {
-          # VC-WIN64-ARM inherits from VC-noCE-common that has no asms.
-          'includes': ['./openssl-fips_no_asm.gypi'],
-        }, 'gas_version and v(gas_version) >= v("2.26") or '
-           'nasm_version and v(nasm_version) >= v("2.11.8")', {
-           # Require AVX512IFMA supported. See
-           # https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_ia32cap.html
-           # Currently crypto/poly1305/asm/poly1305-x86_64.pl requires AVX512IFMA.
-          'includes': ['./openssl-fips_asm.gypi'],
-        }, {
-          'includes': ['./openssl-fips_asm_avx2.gypi'],
-        }],
-     ],
-     'direct_dependent_settings': {
-       'include_dirs': [ 'openssl/include', 'openssl/crypto/include']
-     }
-   },
+    },
   ]
 }

node.gyp

@@ -788,87 +788,22 @@
           ]
         }],
 
-        ['node_fipsinstall=="true"', {
-          'variables': {
-            'openssl-cli': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)openssl-cli<(EXECUTABLE_SUFFIX)',
-            'provider_name': 'libopenssl-fipsmodule',
-            'opensslconfig': './deps/openssl/nodejs-openssl.cnf',
-            'conditions': [
-              ['GENERATOR == "ninja"', {
-	        'fipsmodule_internal': '<(PRODUCT_DIR)/lib/<(provider_name).so',
-                'fipsmodule': '<(PRODUCT_DIR)/obj/lib/openssl-modules/fips.so',
-                'fipsconfig': '<(PRODUCT_DIR)/obj/lib/fipsmodule.cnf',
-                'opensslconfig_internal': '<(PRODUCT_DIR)/obj/lib/openssl.cnf',
-             }, {
-	        'fipsmodule_internal': '<(PRODUCT_DIR)/obj.target/deps/openssl/<(provider_name).so',
-                'fipsmodule': '<(PRODUCT_DIR)/obj.target/deps/openssl/lib/openssl-modules/fips.so',
-                'fipsconfig': '<(PRODUCT_DIR)/obj.target/deps/openssl/fipsmodule.cnf',
-                'opensslconfig_internal': '<(PRODUCT_DIR)/obj.target/deps/openssl/openssl.cnf',
-             }],
-            ],
-          },
-          'actions': [
-            {
-              'action_name': 'fipsinstall',
-              'process_outputs_as_sources': 1,
-              'inputs': [
-                '<(fipsmodule_internal)',
-              ],
-              'outputs': [
-                '<(fipsconfig)',
-              ],
-              'action': [
-                '<(openssl-cli)', 'fipsinstall',
-                '-provider_name', '<(provider_name)',
-                '-module', '<(fipsmodule_internal)',
-                '-out', '<(fipsconfig)',
-                #'-quiet',
-              ],
-            },
-            {
-              'action_name': 'copy_fips_module',
-              'inputs': [
-                '<(fipsmodule_internal)',
-              ],
-              'outputs': [
-                '<(fipsmodule)',
-              ],
-              'action': [
-                '<(python)', 'tools/copyfile.py',
-                '<(fipsmodule_internal)',
-                '<(fipsmodule)',
-              ],
-            },
-            {
-              'action_name': 'copy_openssl_cnf_and_include_fips_cnf',
-              'inputs': [ '<(opensslconfig)', ],
-              'outputs': [ '<(opensslconfig_internal)', ],
-              'action': [
-                '<(python)', 'tools/enable_fips_include.py',
-                '<(opensslconfig)',
-                '<(opensslconfig_internal)',
-                '<(fipsconfig)',
-              ],
-            },
+      ],
+      'variables': {
+        'opensslconfig_internal': '<(obj_dir)/deps/openssl/openssl.cnf',
+        'opensslconfig': './deps/openssl/nodejs-openssl.cnf',
+      },
+      'actions': [
+        {
+          'action_name': 'reset_openssl_cnf',
+          'inputs': [ '<(opensslconfig)', ],
+          'outputs': [ '<(opensslconfig_internal)', ],
+          'action': [
+            '<(python)', 'tools/copyfile.py',
+            '<(opensslconfig)',
+            '<(opensslconfig_internal)',
           ],
-         }, {
-           'variables': {
-              'opensslconfig_internal': '<(obj_dir)/deps/openssl/openssl.cnf',
-              'opensslconfig': './deps/openssl/nodejs-openssl.cnf',
-           },
-           'actions': [
-             {
-               'action_name': 'reset_openssl_cnf',
-               'inputs': [ '<(opensslconfig)', ],
-               'outputs': [ '<(opensslconfig_internal)', ],
-               'action': [
-                 '<(python)', 'tools/copyfile.py',
-                 '<(opensslconfig)',
-                 '<(opensslconfig_internal)',
-               ],
-             },
-           ],
-         }],
+        },
       ],
     }, # node_core_target_name
     {

src/node_config.cc

@@ -64,8 +64,6 @@ static void InitConfig(Local<Object> target,
   READONLY_FALSE_PROPERTY(target, "hasOpenSSL");
 #endif  // HAVE_OPENSSL
 
-  READONLY_TRUE_PROPERTY(target, "fipsMode");
-
 #ifdef NODE_HAVE_I18N_SUPPORT
 
   READONLY_TRUE_PROPERTY(target, "hasIntl");

tools/enable_fips_include.py

@@ -2,7 +2,6 @@ export interface ConfigBinding {
   isDebugBuild: boolean;
   openSSLIsBoringSSL: boolean;
   hasOpenSSL: boolean;
-  fipsMode: boolean;
   hasIntl: boolean;
   hasSmallICU: boolean;
   hasTracing: boolean;