diff --git a/src/node_crypto.cc b/src/node_crypto.cc index 84ab819d54a47f..7dfb3523e36956 100644 --- a/src/node_crypto.cc +++ b/src/node_crypto.cc @@ -6060,11 +6060,14 @@ void GetFipsCrypto(const FunctionCallbackInfo& args) { void SetFipsCrypto(const FunctionCallbackInfo& args) { Environment* env = Environment::GetCurrent(args); #ifdef NODE_FIPS_MODE - bool mode = args[0]->BooleanValue(); + const bool enabled = FIPS_mode(); + const bool enable = args[0]->BooleanValue(); + if (enable == enabled) + return; // No action needed. if (force_fips_crypto) { return env->ThrowError( "Cannot set FIPS mode, it was forced with --force-fips at startup."); - } else if (!FIPS_mode_set(mode)) { + } else if (!FIPS_mode_set(enable)) { unsigned long err = ERR_get_error(); // NOLINT(runtime/int) return ThrowCryptoError(env, err); } diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js index da2dd7b0ba8765..755c6e20c26b2d 100644 --- a/test/parallel/test-crypto-fips.js +++ b/test/parallel/test-crypto-fips.js @@ -212,6 +212,15 @@ testHelper( 'require("crypto").fips = false', process.env); +// --force-fips makes setFipsCrypto enable a no-op (FIPS stays on) +testHelper( + compiledWithFips() ? 'stdout' : 'stderr', + ['--force-fips'], + compiledWithFips() ? FIPS_ENABLED : OPTION_ERROR_STRING, + '(require("crypto").fips = true,' + + 'require("crypto").fips)', + process.env); + // --force-fips and --enable-fips order does not matter testHelper( 'stderr',