Add nodejs fips test #493

tjuhaszrh · 2025-06-18T13:14:52Z

Add two test cases to verify that if:

Container is in fips mode, node is also using fips mode.
Container isnt in fips mode, node also isnt using fips mode.

Nodejs fips state is verified with: node -e 'const crypto = require("crypto"); return crypto.getFips(); which should return the same value (1 for enabled, 0 for disabled) as cat "/proc/sys/crypto/fips_enabled".

phracek · 2025-06-19T07:21:27Z

Let's try first set of shots

[test]

github-actions · 2025-06-19T07:29:44Z

Testing Farm results

name	compose	arch	status	started (UTC)	time	logs
Fedora - 22-minimal	Fedora-latest	x86_64	✅ passed	20.06.2025 07:10:25	7min 28s	test pipeline
CentOS Stream 9 - 20-minimal	CentOS-Stream-9	x86_64	✅ passed	23.06.2025 14:27:23	8min 12s	test pipeline
Fedora - 22	Fedora-latest	x86_64	✅ passed	23.06.2025 14:16:53	10min 12s	test pipeline
Fedora - 20	Fedora-latest	x86_64	✅ passed	23.06.2025 14:16:49	10min 24s	test pipeline
CentOS Stream 10 - 22-minimal	CentOS-Stream-10	x86_64	✅ passed	23.06.2025 14:16:51	8min 27s	test pipeline
CentOS Stream 9 - 20	CentOS-Stream-9	x86_64	✅ passed	23.06.2025 14:16:59	9min 33s	test pipeline
CentOS Stream 10 - 22	CentOS-Stream-10	x86_64	✅ passed	23.06.2025 14:16:55	10min 11s	test pipeline
RHEL9 - FIPS Enabled - 22-minimal	RHEL-9.4.0-Nightly	x86_64	❌ error	23.06.2025 14:16:48	16min 3s	test pipeline
RHEL9 - FIPS Enabled - 20	RHEL-9.4.0-Nightly	x86_64	❌ error	23.06.2025 14:16:50	16min 9s	test pipeline
RHEL10 - 22-minimal	RHEL-10-Nightly	x86_64	✅ passed	23.06.2025 14:27:23	24min 38s	test pipeline
RHEL8 - 22	RHEL-8.10.0-Nightly	x86_64	✅ passed	23.06.2025 14:16:58	19min 22s	test pipeline
RHEL10 - 22	RHEL-10-Nightly	x86_64	✅ passed	23.06.2025 14:27:29	38min 35s	test pipeline
RHEL8 - 22-minimal	RHEL-8.10.0-Nightly	x86_64	✅ passed	23.06.2025 14:27:13	28min 56s	test pipeline
RHEL10 - FIPS Enabled - 22-minimal	RHEL-10-Nightly	x86_64	❌ error	23.06.2025 14:16:53	18min 58s	test pipeline
RHEL9 - FIPS Enabled - 20-minimal	RHEL-9.4.0-Nightly	x86_64	❌ error	23.06.2025 14:16:50	15min 58s	test pipeline
RHEL10 - FIPS Enabled - 22	RHEL-10-Nightly	x86_64	❌ error	23.06.2025 14:16:47	20min 2s	test pipeline
RHEL9 - FIPS Enabled - 22	RHEL-9.4.0-Nightly	x86_64	❌ error	23.06.2025 14:16:51	15min 59s	test pipeline
RHEL9 - 22-minimal	RHEL-9.4.0-Nightly	x86_64	✅ passed	19.06.2025 07:21:38	20min 41s	test pipeline
RHEL8 - 20-minimal	RHEL-8.10.0-Nightly	x86_64	✅ passed	23.06.2025 14:17:08	18min 34s	test pipeline
RHEL8 - 20	RHEL-8.10.0-Nightly	x86_64	✅ passed	23.06.2025 14:16:48	18min 48s	test pipeline
RHEL9 - 20-minimal	RHEL-9.4.0-Nightly	x86_64	✅ passed	23.06.2025 14:16:48	21min 44s	test pipeline
RHEL9 - 22	RHEL-9.4.0-Nightly	x86_64	✅ passed	23.06.2025 14:17:26	21min 21s	test pipeline
Fedora - 20-minimal	Fedora-latest	x86_64	✅ passed	23.06.2025 14:16:50	8min 48s	test pipeline
RHEL9 - 20	RHEL-9.4.0-Nightly	x86_64	✅ passed	23.06.2025 14:16:48	20min 55s	test pipeline

phracek · 2025-06-19T07:36:18Z

@tjuhaszrh The error is here:

Running test test_nodejs_fips_mode_off (starting at 2025-06-19 07:27:56+00:00) ... 
-----------------------------------------------
[eval]:1
(crypto=>{{const crypto = require(crypto); return crypto.getFips();}})(require('node:crypto'))
                                  ^

ReferenceError: Cannot access 'crypto' before initialization
    at [eval]:1:35
    at [eval]:1:71
    at runScriptInThisContext (node:internal/vm:209:10)
    at node:internal/process/execution:449:12
    at [eval]-wrapper:6:24
    at runScriptInContext (node:internal/process/execution:447:60)
    at evalFunction (node:internal/process/execution:87:30)
    at evalScript (node:internal/process/execution:99:3)
    at node:internal/main/eval_string:74:3

Node.js v22.15.0

phracek · 2025-06-19T10:24:22Z

@tjuhaszrh Thanks for this pull request. I have several question regarding nodeJs.

What do you thinkg about this code?

function test_nodejs_fips_mode_off() {
  local ret_val
  local is_fips_enabled
  # Read fips mode from host in case exists
  if [[ -f /proc/sys/crypto/fips_enabled ]]; then
    is_fips_enabled=$(cat /proc/sys/crypto/fips_enabled)
  else
    # Set to 0 if not exists
    is_fips_enabled="0"
  fi
  if [[ "$is_fips_enabled" == "0" ]]; then
    echo "FIPS is disabled on host"
    echo "What is expected output in case disabled fips???"
    fips=$(docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "! node -e 'const crypto = require("crypto"); return crypto.getFips();'")
    echo "FIPS from app: '$fips'" # For me $fips is empty...
    if [[ "$fips" == "" ]]; then
      ct_check_testcase_result "0"
    else
      ct_check_testcase_result "$retval"
    fi
  else
    # What is expected behavior here in case FIPS is enabled and we test for fips is disabled. Does it make sense either?
    # Check fips mode in container as well
    if docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "cat /proc/sys/crypto/fips_enabled | grep -q 0"; then
      fips=$(docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "node -e 'const crypto = require("crypto"); return crypto.getFips();'")
      echo "FIPS from app: '$fips'"
      ct_check_testcase_result "$?"
    fi
  fi
}

tjuhaszrh · 2025-06-19T14:42:32Z

[test]

tjuhaszrh · 2025-06-19T14:53:05Z

Sorry I think the issue was caused just by messy string nesting in require("crypto") .

Adding backslash seems to have fixed it.

➜  test git:(fips-nodejs) fips=$(podman run --rm localhost/node-app:latest /bin/bash -c "! node -e 'const crypto = require("crypto"); return crypto.getFips();'")             
[eval]:1
(crypto=>{{const crypto = require(crypto); return crypto.getFips();}})(require('node:crypto'))
                                  ^

ReferenceError: Cannot access 'crypto' before initialization
    at [eval]:1:35
    at [eval]:1:71
    at runScriptInThisContext (node:internal/vm:209:10)
    at node:internal/process/execution:118:14
    at [eval]-wrapper:6:24
    at runScript (node:internal/process/execution:101:62)
    at evalScript (node:internal/process/execution:133:3)
    at node:internal/main/eval_string:51:3

Node.js v20.19.2
➜  test git:(fips-nodejs) fips=$(podman run --rm localhost/node-app:latest /bin/bash -c "! node -e 'const crypto = require(\"crypto\"); return crypto.getFips();'")           
➜  test git:(fips-nodejs)

tjuhaszrh · 2025-06-19T15:23:41Z

@tjuhaszrh Thanks for this pull request. I have several question regarding nodeJs.

What do you thinkg about this code?

function test_nodejs_fips_mode_off() {
  local ret_val
  local is_fips_enabled
  # Read fips mode from host in case exists
  if [[ -f /proc/sys/crypto/fips_enabled ]]; then
    is_fips_enabled=$(cat /proc/sys/crypto/fips_enabled)
  else
    # Set to 0 if not exists
    is_fips_enabled="0"
  fi
  if [[ "$is_fips_enabled" == "0" ]]; then
    echo "FIPS is disabled on host"
    echo "What is expected output in case disabled fips???"
    fips=$(docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "! node -e 'const crypto = require("crypto"); return crypto.getFips();'")
    echo "FIPS from app: '$fips'" # For me $fips is empty...
    if [[ "$fips" == "" ]]; then
      ct_check_testcase_result "0"
    else
      ct_check_testcase_result "$retval"
    fi
  else
    # What is expected behavior here in case FIPS is enabled and we test for fips is disabled. Does it make sense either?
    # Check fips mode in container as well
    if docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "cat /proc/sys/crypto/fips_enabled | grep -q 0"; then
      fips=$(docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "node -e 'const crypto = require("crypto"); return crypto.getFips();'")
      echo "FIPS from app: '$fips'"
      ct_check_testcase_result "$?"
    fi
  fi
}

My understanding is that crypto.getFips(); returns exactly the same values as cat /proc/sys/crypto/fips_enabled (so 1 for enabled, 0 for disabled fips).

My usage of the fips variable was also wrong since I only care about the $? value and it doesn't store anything, I got slightly to inspired by the nodemon test.

So I think:
if [[ "$is_fips_enabled" == "0" ]]; then echo "FIPS is disabled on host" echo "What is expected output in case disabled fips???" fips=$(docker run --rm ${IMAGE_NAME}-testapp /bin/bash -c "! node -e 'const crypto = require("crypto"); return crypto.getFips();'") echo "FIPS from app: '$fips'" # For me $fips is empty... if [[ "$fips" == "" ]]; then ct_check_testcase_result "0" else ct_check_testcase_result "$retval" fi
this would probably always pass.

tjuhaszrh · 2025-06-19T15:45:15Z

Adjustments:

removed unused variable fips.
moved the logic into one function that verifies both states of fips mode.
added check for presence of /proc/sys/crypto/fips_enabled file.

mhdawson · 2025-06-19T21:37:16Z

Great to see this test being added

phracek · 2025-06-20T07:10:14Z

[test]

phracek · 2025-06-23T08:16:02Z

Great to see this test being added

Hi @mhdawson , does it make sense to test also some a simple app, like we have in directory test-app (https://github.com/sclorg/s2i-nodejs-container/tree/master/test/test-app) also for FIPS mode? But may be with different name, like test-fips? What do you think?

phracek

It is almost done. Thanks for this pull request. Great work.

test/test-lib-nodejs.sh

Add test that verifies that if: Container is in fips mode, node is also using fips mode. Container isnt in fips mode, node also isnt using fips mode.

phracek · 2025-06-23T14:16:37Z

[test]

mhdawson · 2025-06-23T15:49:14Z

@phracek a simple test application would be a good idea as well.

phracek · 2025-06-24T07:48:17Z

@tjuhaszrh Add to this pull request also fips https://github.com/sclorg/s2i-nodejs-container/blob/master/test/test-lib-nodejs.sh#L133
The code should be like

    app|hw|fips|express-webapp|binary)
      pushd "${test_dir}/test-${1}" >/dev/null
      prepare_dummy_git_repo
      popd >/dev/null
      ;;

Add there also function like is here https://github.com/sclorg/s2i-nodejs-container/blob/master/test/test-lib-nodejs.sh#L44

run_s2i_build_fips() {
  ct_s2i_build_as_df file://${test_dir}/test-fips ${IMAGE_NAME} ${IMAGE_NAME}-testfips ${s2i_args} $(ct_build_s2i_npm_variables) $1
}

tjuhaszrh force-pushed the fips-nodejs branch from d3e5d1f to 795f826 Compare June 19, 2025 14:42

tjuhaszrh force-pushed the fips-nodejs branch 2 times, most recently from c36fca6 to 415e2cd Compare June 19, 2025 15:44

tjuhaszrh force-pushed the fips-nodejs branch 2 times, most recently from 364e024 to 31dd709 Compare June 23, 2025 08:15

tjuhaszrh force-pushed the fips-nodejs branch from 31dd709 to 51e15e1 Compare June 23, 2025 08:23

phracek requested changes Jun 23, 2025

View reviewed changes

test/test-lib-nodejs.sh Outdated Show resolved Hide resolved

test/test-lib-nodejs.sh Outdated Show resolved Hide resolved

test/test-lib-nodejs.sh Outdated Show resolved Hide resolved

tjuhaszrh force-pushed the fips-nodejs branch from 51e15e1 to cfff436 Compare June 23, 2025 08:47

Add nodejs fips test

2c3f72f

Add test that verifies that if: Container is in fips mode, node is also using fips mode. Container isnt in fips mode, node also isnt using fips mode.

tjuhaszrh force-pushed the fips-nodejs branch from cfff436 to 2c3f72f Compare June 23, 2025 08:50

tjuhaszrh requested a review from phracek June 23, 2025 09:27

Add nodejs fips test #493

Are you sure you want to change the base?

Add nodejs fips test #493

Uh oh!

Conversation

tjuhaszrh commented Jun 18, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

phracek commented Jun 19, 2025

Uh oh!

github-actions bot commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing Farm results

Uh oh!

phracek commented Jun 19, 2025

Uh oh!

phracek commented Jun 19, 2025

Uh oh!

tjuhaszrh commented Jun 19, 2025

Uh oh!

tjuhaszrh commented Jun 19, 2025

Uh oh!

tjuhaszrh commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tjuhaszrh commented Jun 19, 2025

Uh oh!

mhdawson commented Jun 19, 2025

Uh oh!

phracek commented Jun 20, 2025

Uh oh!

phracek commented Jun 23, 2025

Uh oh!

phracek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

phracek commented Jun 23, 2025

Uh oh!

mhdawson commented Jun 23, 2025

Uh oh!

phracek commented Jun 24, 2025

Uh oh!

Uh oh!

tjuhaszrh commented Jun 18, 2025 •

edited by github-actions bot

Loading

github-actions bot commented Jun 19, 2025 •

edited

Loading

tjuhaszrh commented Jun 19, 2025 •

edited

Loading