Enabling FIPS results in `library has no ciphers` error #50543

trevor-vaughan · 2023-11-03T15:55:08Z

trevor-vaughan
Nov 3, 2023

Version

v20.9.0

Platform

Linux mahhost 5.14.0-284.30.1.el9_2.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Aug 25 09:13:12 EDT 2023 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

Object.fetch

What steps will reproduce the bug?

Affected Versions

20.9.0
18.18.2
16.20.0 (using node-fetch)

System Setup

RHEL 9 in FIPS mode
- fips-mode-setup --enable
- reboot
Crypto Policy set to FIPS:NO-ENFORCE-EMS
- update-crypto-polocies --set FIPS:NO-ENFORCE-EMS
- reboot

Reproducer

The following test file will cause the failure:

const crypto = require('crypto')

const url = 'https://www.google.com'
async function main() {
  const response = await fetch(url)

  const body = await response.text()

  console.log('Body Length: ' + body.length)
}

console.log('FIPS Status: ' + crypto.getFips())

let hash = crypto.createHash('md5').update('test').digest("hex")
console.log('HASH: ' + hash)

crypto.setFips(true)
console.log('FIPS Status: ' + crypto.getFips())
// Fails correctly
//hash = crypto.createHash('md5').update('test').digest("hex")
//console.log('HASH: ' + hash)

main()

How often does it reproduce? Is there a required condition?

No response

What is the expected behavior? Why is that the expected behavior?

No response

What do you see instead?

node index.js 
FIPS Status: 0
HASH: 098f6bcd4621d373cade4e832627b4f6
FIPS Status: 1
node:internal/deps/undici/undici:11372
    Error.captureStackTrace(err, this);
          ^

TypeError: fetch failed
    at Object.fetch (node:internal/deps/undici/undici:11372:11)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async main (/home/asve/Work/node_crypto_test/index.js:5:20) {
  cause: Error: error:0A0000A1:SSL routines::library has no ciphers
      at new SecureContext (node:_tls_common:88:16)
      at Object.createSecureContext (node:_tls_common:113:13)
      at Object.connect (node:_tls_wrap:1748:48)
      at Client.connect (node:internal/deps/undici/undici:6542:24)
      at socket (node:internal/deps/undici/undici:8055:29)
      at new Promise (<anonymous>)
      at connect (node:internal/deps/undici/undici:8054:30)
      at _resume (node:internal/deps/undici/undici:8247:11)
      at resume (node:internal/deps/undici/undici:8173:7)
      at [dispatch] (node:internal/deps/undici/undici:7436:11) {
    library: 'SSL routines',
    reason: 'library has no ciphers',
    code: 'ERR_SSL_LIBRARY_HAS_NO_CIPHERS'
  }
}

Node.js v20.9.0

Additional information

Openssl Version

openssl-3.0.7-17.el9_2.x86_64
OpenSSL 3.0.7 1 Nov 2022 (Library: OpenSSL 3.0.7 1 Nov 2022)

Openssl s_client works properly

depth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1
verify return:1
depth=1 C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
verify return:1
depth=0 CN = www.google.com
verify return:1
CONNECTED(00000003)
---
Certificate chain
 0 s:CN = www.google.com
   i:C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: RSA-SHA256
   v:NotBefore: Oct 16 08:10:46 2023 GMT; NotAfter: Jan  8 08:10:45 2024 GMT
 1 s:C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
   i:C = US, O = Google Trust Services LLC, CN = GTS Root R1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Aug 13 00:00:42 2020 GMT; NotAfter: Sep 30 00:00:42 2027 GMT
 2 s:C = US, O = Google Trust Services LLC, CN = GTS Root R1
   i:C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jun 19 00:00:42 2020 GMT; NotAfter: Jan 28 00:00:42 2028 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIEiDCCA3CgAwIBAgIRANWbO75xUE3iCciPw5PuELgwDQYJKoZIhvcNAQELBQAw
RjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBM
TEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMDE2MDgxMDQ2WhcNMjQwMTA4
MDgxMDQ1WjAZMRcwFQYDVQQDEw53d3cuZ29vZ2xlLmNvbTBZMBMGByqGSM49AgEG
CCqGSM49AwEHA0IABNXoseaoLuoVmAKAkxlfsklzcG0o0WTSfrE6hukzPe33RV5a
qYH3vYFWCOYvPFE5PjtNrv1veDW87Q5G8ZbKAXSjggJnMIICYzAOBgNVHQ8BAf8E
BAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4E
FgQU7+YfhQzBKtvwNK5qbNU9zTfECHEwHwYDVR0jBBgwFoAUinR/r4XN7pXNPZzQ
4kYU83E1HScwagYIKwYBBQUHAQEEXjBcMCcGCCsGAQUFBzABhhtodHRwOi8vb2Nz
cC5wa2kuZ29vZy9ndHMxYzMwMQYIKwYBBQUHMAKGJWh0dHA6Ly9wa2kuZ29vZy9y
ZXBvL2NlcnRzL2d0czFjMy5kZXIwGQYDVR0RBBIwEIIOd3d3Lmdvb2dsZS5jb20w
IQYDVR0gBBowGDAIBgZngQwBAgEwDAYKKwYBBAHWeQIFAzA8BgNVHR8ENTAzMDGg
L6AthitodHRwOi8vY3Jscy5wa2kuZ29vZy9ndHMxYzMvUXFGeGJpOU00OGMuY3Js
MIIBBAYKKwYBBAHWeQIEAgSB9QSB8gDwAHUASLDja9qmRzQP5WoC+p0w6xxSActW
3SyB2bu/qznYhHMAAAGLN8CKdAAABAMARjBEAiAdezwSUg6BBd9E039NAbzJxjbG
5CNBzL+LF0HHet+GFQIgS/w4yFl1xd6SjYltwVc/WjWs041aIlsAeWvyafpP/F8A
dwB2/4g/Crb7lVHCYcz1h7o0tKTNuyncaEIKn+ZnTFo6dAAAAYs3wIqDAAAEAwBI
MEYCIQDe6skoYfPLfZboC6bVd2sxsJ2rdkD5qvJdVYd1TngFYgIhALuA+f2e8X2H
boOZj0KRGLbNwKVqMHPEXigBuDh2VHYrMA0GCSqGSIb3DQEBCwUAA4IBAQAU/XRP
7utXb9y7KOeVtb0fpWPqvX+38YLAmWr2j4pITN97iFhjWYJ2GTE7sx4b46gKZ8KP
pBnuOMhIhltKDYQ0BFe3Vy8T92iLf9liI8aEfXmavLMRrIRB4IMushOgwX4IQOwE
eSNJ1q+ntNziOXdXHFXyDYV19A6uL3sBkRLAHqmb8gclosTTwMoeOuU59KlwcreU
fCvlswixnaO5Km9CdO8Tt7G3KkIwZR5X6iMwWHDfCsdmOUixWVEMEP6NVoUSMHYX
RnBN6qieEHV3ihhQw3yGHaGKJnMqjIuXVQyeLVdX6qhGUl5QmIv0ldhtY3io6EDA
IlD0GxLU38BvT1HF
-----END CERTIFICATE-----
subject=CN = www.google.com
issuer=C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: ECDH, prime256v1, 256 bits
---
SSL handshake has read 4328 bytes and written 379 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
DONE

Answered by richardlau

Nov 3, 2023

How are you configuring your build? By default Node.js will look for nodejs_conf in any loaded OpenSSL configuration and will not by default process openssl_conf. You can set that back to openssl_conf with --openssl-conf-name:

node/BUILDING.md

Lines 794 to 805 in 4dbb017

     ### Configure OpenSSL appname  
    
   Node.js can use an OpenSSL configuration file by specifying the environment  
   variable `OPENSSL_CONF`, or using the command line option `--openssl-conf`, and  
   if none of those are specified will default to reading the default OpenSSL  
   configuration file `openssl.cnf`. Node.js will only read a section that is by  
   default named `nodejs_conf`, but this name c…

View full answer

bnoordhuis · 2023-11-03T16:24:15Z

bnoordhuis
Nov 3, 2023
Collaborator

Why do you report that here? Rephrased: what makes you think this is a node.js bug?

0 replies

trevor-vaughan · 2023-11-03T16:33:46Z

trevor-vaughan
Nov 3, 2023
Author

Why do you report that here? Rephrased: what makes you think this is a node.js bug?

The node that I'm using was linked against the system openssl. Everything else on the system using the library works as expected and the error is coming from the internals of node.

While it may not be a node issue, I'm not sure what else it would be from the material provided.

If there is some way to pinpoint how this is not a node issue, I'm happy to give them a go.

0 replies

bnoordhuis · 2023-11-03T16:38:17Z

bnoordhuis
Nov 3, 2023
Collaborator

That error bubbles up from openssl, not node. It's almost certainly a configuration issue on your end.

If you're using a vendor-provided node build (i.e., one that's not been built by us), you should report issues to them.

0 replies

trevor-vaughan · 2023-11-03T16:40:33Z

trevor-vaughan
Nov 3, 2023
Author

I'm building directly from your source.

Direct connections using openssl itself have no issue as shown in my issue report.

8 replies

richardlau Nov 3, 2023
Maintainer

How are you configuring your build? By default Node.js will look for nodejs_conf in any loaded OpenSSL configuration and will not by default process openssl_conf. You can set that back to openssl_conf with --openssl-conf-name:

node/BUILDING.md

Lines 794 to 805 in 4dbb017

    
           ### Configure OpenSSL appname 
        
           Node.js can use an OpenSSL configuration file by specifying the environment 
        
           variable `OPENSSL_CONF`, or using the command line option `--openssl-conf`, and 
        
           if none of those are specified will default to reading the default OpenSSL 
        
           configuration file `openssl.cnf`. Node.js will only read a section that is by 
        
           default named `nodejs_conf`, but this name can be overridden using the following 
        
           configure option: 
        
           ```bash 
        
           ./configure --openssl-conf-name=<some_conf_name> 
        
           ```

Answer selected by trevor-vaughan

trevor-vaughan Nov 3, 2023
Author

I'm currently building following the linked guide and I'm thinking that this may be the RHEL9 version of #28531.

Interestingly, the native nodejs build from the vendor also displays the same behavior.

trevor-vaughan Nov 3, 2023
Author

Giving your suggestion a go.

trevor-vaughan Nov 3, 2023
Author

Apologies, I just realized that I didn't actually clearly answer your question.

I was using --shared-openssl --openssl-is-fips during the build.

trevor-vaughan Nov 3, 2023
Author

This was indeed the solution and the native RHEL 9 build is incorrect 🤦

Much appreciated @richardlau

bnoordhuis · 2023-11-03T17:19:58Z

bnoordhuis
Nov 3, 2023
Collaborator

Have you tried the --enable-fips or --force-fips command line flags instead of turning it on at runtime?

0 replies

trevor-vaughan · 2023-11-03T18:08:25Z

trevor-vaughan
Nov 3, 2023
Author

That resulted in a more interesting error:

node --enable-fips index.js 
node[1463827]: ../src/node.cc:1068:std::unique_ptr<node::InitializationResult> node::InitializeOncePerProcess(const std::vector<std::__cxx11::basic_string<char> >&, node::ProcessFlags::Flags): Assertion `crypto::CSPRNG(nullptr, 0).is_ok()' failed.
 1: 0xb17c70 node::Abort() [node]
 2: 0xb17cee  [node]
 3: 0xad4b41 node::InitializeOncePerProcess(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&, node::ProcessFlags::Flags) [node]
 4: 0xad4d93 node::Start(int, char**) [node]
 5: 0x7fc3a663feb0  [/lib64/libc.so.6]
 6: 0x7fc3a663ff60 __libc_start_main [/lib64/libc.so.6]
 7: 0xa47e75 _start [node]
Aborted (core dumped)

0 replies

bnoordhuis · 2023-11-03T18:21:38Z

bnoordhuis
Nov 3, 2023
Collaborator

That's a fail-safe. There's something wrong with your system or your setup that causes openssl's entropy pool to fail to initialize.

I'm going to convert this to a discussion because nothing so far has been a clear indicator of actual bugs.

4 replies

trevor-vaughan Nov 3, 2023
Author

No worries. This may be related nodejs/help#4159

mhdawson Nov 14, 2023
Maintainer

@trevor-vaughan I'm curious why you are building your own Node.js binaries versus using the RPMs available in RHEL/ubi which alread use the system OpenSSL?

trevor-vaughan Nov 14, 2023
Author

Heh, a few reasons:

To test against very specific NodeJS versions
Modularity makes it VERY difficult to mirror a small set of packages
Can't install more than one version of node on a system using native tools
The native Node 16 (default) had this issue :-/

mhdawson Nov 17, 2023
Maintainer

@trevor-vaughan thanks for the info.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Node.js

Enabling FIPS results in `library has no ciphers` error #50543

{{title}}

Replies: 7 comments 12 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

	### Configure OpenSSL appname

	Node.js can use an OpenSSL configuration file by specifying the environment
	variable `OPENSSL_CONF`, or using the command line option `--openssl-conf`, and
	if none of those are specified will default to reading the default OpenSSL
	configuration file `openssl.cnf`. Node.js will only read a section that is by
	default named `nodejs_conf`, but this name c…

Node.js

Enabling FIPS results in library has no ciphers error #50543

trevor-vaughan Nov 3, 2023

Version

Platform

Subsystem

What steps will reproduce the bug?

Affected Versions

System Setup

Reproducer

How often does it reproduce? Is there a required condition?

What is the expected behavior? Why is that the expected behavior?

What do you see instead?

Additional information

Openssl Version

Openssl s_client works properly

Replies: 7 comments · 12 replies

bnoordhuis Nov 3, 2023 Collaborator

trevor-vaughan Nov 3, 2023 Author

bnoordhuis Nov 3, 2023 Collaborator

trevor-vaughan Nov 3, 2023 Author

richardlau Nov 3, 2023 Maintainer

trevor-vaughan Nov 3, 2023 Author

trevor-vaughan Nov 3, 2023 Author

trevor-vaughan Nov 3, 2023 Author

trevor-vaughan Nov 3, 2023 Author

bnoordhuis Nov 3, 2023 Collaborator

trevor-vaughan Nov 3, 2023 Author

bnoordhuis Nov 3, 2023 Collaborator

trevor-vaughan Nov 3, 2023 Author

mhdawson Nov 14, 2023 Maintainer

trevor-vaughan Nov 14, 2023 Author

mhdawson Nov 17, 2023 Maintainer

Enabling FIPS results in `library has no ciphers` error #50543

trevor-vaughan
Nov 3, 2023

Replies: 7 comments 12 replies

bnoordhuis
Nov 3, 2023
Collaborator

trevor-vaughan
Nov 3, 2023
Author

bnoordhuis
Nov 3, 2023
Collaborator

trevor-vaughan
Nov 3, 2023
Author

richardlau Nov 3, 2023
Maintainer

trevor-vaughan Nov 3, 2023
Author

trevor-vaughan Nov 3, 2023
Author

trevor-vaughan Nov 3, 2023
Author

trevor-vaughan Nov 3, 2023
Author

bnoordhuis
Nov 3, 2023
Collaborator

trevor-vaughan
Nov 3, 2023
Author

bnoordhuis
Nov 3, 2023
Collaborator

trevor-vaughan Nov 3, 2023
Author

mhdawson Nov 14, 2023
Maintainer

trevor-vaughan Nov 14, 2023
Author

mhdawson Nov 17, 2023
Maintainer