crypto: add strict mode to --force-fips

Allow --force-fips to take an optional provider or strict mode. Keep
provider as the current default and explicit compatibility mode.

In strict mode, return failure from the OpenSSL 3.4+ FIPS indicator
callback when it reports a non-approved operation. Install the callback
for enforcement without implicitly enabling diagnostics;
--enable-fips-indicator-events remains the independent observation
opt-in.

Keep the bare form mapped to provider for compatibility, allowing the
default to change to strict in a future major release. Preserve the mode
when forwarding flags to child test processes, and keep the parser's
internal mode storage out of process.allowedNodeEnvironmentFlags.

Document the callback scope limitations and cover provider
compatibility, validation, synchronous crypto, WebCrypto, Workers, and
opt-in event publication.

PR-URL: #65645
Backport-PR-URL: #66128
Assisted-by: Codex
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: panva

doc/api/cli.md

@@ -1397,15 +1397,34 @@ added: v12.12.0
 
 Disable loading native addons that are not [context-aware][].
 
-### `--force-fips`
+<a id="--force-fips"></a>
+
+### `--force-fips[=mode]`
 
 <!-- YAML
 added: v6.0.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65645
+    description: Added the optional `provider` and `strict` modes.
 -->
 
 Enable [FIPS mode][] at startup and prevent it from being disabled from script
 code. The same OpenSSL requirements as [`--enable-fips`][] apply.
 
+An optional mode can be specified using `--force-fips=mode`:
+
+* `provider`: Preserve the OpenSSL FIPS provider's configured handling of
+  non-approved operations. This is the current default when the mode is
+  omitted.
+* `strict`: Reject non-approved operations reported through the OpenSSL FIPS
+  indicator callback. This mode requires OpenSSL 3.4 or later.
+
+The `strict` mode only covers operations reported through the callback for
+OpenSSL's default library context. It does not cover native addons that use
+another `OSSL_LIB_CTX` or another copy of `libcrypto`, nor operation-specific
+indicators that do not invoke the callback.
+
 ### `--force-node-api-uncaught-exceptions-policy`
 
 <!-- YAML

doc/api/crypto.md

@@ -7176,7 +7176,9 @@ startup. The following controls are also available:
 * [`--enable-fips`][] and [`--force-fips`][] enable the property query and
   additionally require the configured provider named `fips` to initialize and
   pass its self-test. Node.js exits if that check fails. `--force-fips` also
-  prevents FIPS mode from being disabled from script code.
+  prevents FIPS mode from being disabled from script code. With
+  `--force-fips=strict`, Node.js also rejects non-approved operations reported
+  through the OpenSSL FIPS indicator callback.
 * [`crypto.setFips()`][] changes the FIPS/property-query state. On OpenSSL 3, it
   does not install, load, initialize, or validate a provider. Implementations
   fetched before the call are not changed.
@@ -7519,7 +7521,7 @@ See the [list of SSL OP Flags][] for details.
 [`--allow-openssl-store`]: cli.md#--allow-openssl-store
 [`--enable-fips-indicator-events`]: cli.md#--enable-fips-indicator-events
 [`--enable-fips`]: cli.md#--enable-fips
-[`--force-fips`]: cli.md#--force-fips
+[`--force-fips`]: cli.md#--force-fipsmode
 [`--openssl-config`]: cli.md#--openssl-configfile
 [`--openssl-shared-config`]: cli.md#--openssl-shared-config
 [`BN_is_prime_ex`]: https://www.openssl.org/docs/man1.1.1/man3/BN_is_prime_ex.html

doc/api/diagnostics_channel.md

@@ -1162,8 +1162,7 @@ added: REPLACEME
 * `operation` {string} The provider-defined operation type.
 * `reason` {string} The provider-defined description of why the operation is
   not approved.
-* `blocked` {boolean} Whether a native indicator callback installed before
-  Node.js blocked the operation.
+* `blocked` {boolean} Whether an indicator callback blocked the operation.
 * `count` {number} The number of matching pending indicator invocations
   represented by this message.
 * `dropped` {number} The number of additional indicator invocations dropped
@@ -1181,7 +1180,10 @@ messages are published.
 
 Subscribing to the channel is observation-only and never changes the result of
 an operation. Node.js preserves the result from any native indicator callback
-installed before Node.js initializes its crypto support.
+installed before Node.js initializes its crypto support. When
+[`--force-fips=strict`][] is used, Node.js rejects callback-indicated
+non-approved operations whether or not indicator events are enabled or the
+channel has subscribers.
 
 Messages are published asynchronously on the main thread because OpenSSL
 indicators can originate from Workers or other threads. Only subscriptions on
@@ -1604,6 +1606,7 @@ statement, since both are still in use while the event is being delivered; see
 [TracingChannel Channels]: #tracingchannel-channels
 [`'uncaughtException'`]: process.md#event-uncaughtexception
 [`--enable-fips-indicator-events`]: cli.md#--enable-fips-indicator-events
+[`--force-fips=strict`]: cli.md#--force-fipsmode
 [`DatabaseSync`]: sqlite.md#class-databasesync
 [`TracingChannel`]: #class-tracingchannel
 [`asyncEnd` event]: #asyncendevent

doc/api/errors.md

@@ -4586,7 +4586,7 @@ An error occurred trying to allocate memory. This should never happen.
 [`"imports"`]: packages.md#imports
 [`'uncaughtException'`]: process.md#event-uncaughtexception
 [`--disable-proto=throw`]: cli.md#--disable-protomode
-[`--force-fips`]: cli.md#--force-fips
+[`--force-fips`]: cli.md#--force-fipsmode
 [`--no-addons`]: cli.md#--no-addons
 [`--unhandled-rejections`]: cli.md#--unhandled-rejectionsmode
 [`BoundSocket`]: net.md#class-netboundsocket

doc/node.1

@@ -327,9 +327,23 @@ Enable experimental support for storage inspection.
 .It Fl -force-context-aware
 Disable loading native addons that are not context-aware.
 .
-.It Fl -force-fips
+.It Fl -force-fips Ns = Ns Ar [mode]
 Enable FIPS mode at startup and prevent it from being disabled from script
 code. The same OpenSSL requirements as \fB--enable-fips\fR apply.
+An optional mode can be specified using \fB--force-fips=mode\fR:
+.Bl -bullet
+.It
+\fBprovider\fR: Preserve the OpenSSL FIPS provider's configured handling of
+non-approved operations. This is the current default when the mode is
+omitted.
+.It
+\fBstrict\fR: Reject non-approved operations reported through the OpenSSL FIPS
+indicator callback. This mode requires OpenSSL 3.4 or later.
+.El
+The \fBstrict\fR mode only covers operations reported through the callback for
+OpenSSL's default library context. It does not cover native addons that use
+another \fBOSSL_LIB_CTX\fR or another copy of \fBlibcrypto\fR, nor operation-specific
+indicators that do not invoke the callback.
 .
 .It Fl -frozen-intrinsics
 Enable experimental frozen intrinsics support.

lib/internal/process/per_thread.js

@@ -392,6 +392,9 @@ function buildAllowedFlags() {
 
   const allowedNodeEnvironmentFlags = [];
   for (const { 0: name, 1: info } of options) {
+    // Bracketed options are internal parser targets. They can be allowed in
+    // NODE_OPTIONS so aliases expand to them, but are not public flags.
+    if (name[0] === '[') continue;
     if (info.envVarSettings === kAllowedInEnvvar) {
       ArrayPrototypePush(allowedNodeEnvironmentFlags, name);
       if (info.type === kBoolean) {

src/crypto/crypto_util.cc

@@ -254,6 +254,10 @@ class FipsIndicatorState final {
   }
 
   void Install() {
+    reject_unapproved_.store(
+        per_process::cli_options->force_fips_crypto &&
+            per_process::cli_options->force_fips_crypto_policy == "strict",
+        std::memory_order_release);
     std::call_once(install_once_, [this]() {
       OSSL_INDICATOR_get_callback(nullptr, &previous_callback_);
       OSSL_INDICATOR_set_callback(nullptr, OnOpenSSLIndicator);
@@ -314,9 +318,12 @@ class FipsIndicatorState final {
         previous_callback_ == nullptr
             ? 1
             : previous_callback_(operation, reason, params);
-    if (!active_.load(std::memory_order_acquire)) return previous_result;
+    const int result = reject_unapproved_.load(std::memory_order_acquire)
+                           ? 0
+                           : previous_result;
+    if (!active_.load(std::memory_order_acquire)) return result;
 
-    const bool blocked = previous_result == 0;
+    const bool blocked = result == 0;
     {
       Mutex::ScopedLock lock(mutex_);
       if (env_ != nullptr && active_.load(std::memory_order_relaxed)) {
@@ -349,7 +356,7 @@ class FipsIndicatorState final {
         }
       }
     }
-    return previous_result;
+    return result;
   }
 
   void Drain(Environment* env) {
@@ -404,6 +411,7 @@ class FipsIndicatorState final {
 
   std::once_flag install_once_;
   std::atomic<bool> active_{false};
+  std::atomic<bool> reject_unapproved_{false};
   OSSL_INDICATOR_CALLBACK* previous_callback_ = nullptr;
   Mutex mutex_;
   Environment* env_ = nullptr;
@@ -419,7 +427,10 @@ class FipsIndicatorState final {
 
 void InstallFipsIndicatorCallback() {
 #if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
-  if (per_process::cli_options->enable_fips_indicator_events) {
+  const auto& options = per_process::cli_options;
+  const bool strict = options->force_fips_crypto &&
+                      options->force_fips_crypto_policy == "strict";
+  if (options->enable_fips_indicator_events || strict) {
     FipsIndicatorState::Get().Install();
   }
 #endif

src/node.cc

@@ -1256,13 +1256,13 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
       OPENSSL_init();
     }
 #endif
-    crypto::InstallFipsIndicatorCallback();
     if (auto fips_error = crypto::ProcessFipsOptions()) {
       result->exit_code_ = ExitCode::kGenericUserError;
       result->early_return_ = true;
       result->errors_.emplace_back(std::move(*fips_error));
       return result;
     }
+    crypto::InstallFipsIndicatorCallback();
 
     // Ensure CSPRNG is properly seeded.
     CHECK(ncrypto::CSPRNG(nullptr, 0));

src/node_options.cc

@@ -84,11 +84,21 @@ void PerProcessOptions::CheckOptions(std::vector<std::string>* errors,
                       "used, not both");
   }
 
+  if (force_fips_crypto_policy != "provider" &&
+      force_fips_crypto_policy != "strict") {
+    errors->push_back(
+        "invalid value for --force-fips; expected 'provider' or 'strict'");
+  }
+
 #if defined(OPENSSL_IS_BORINGSSL) || !OPENSSL_VERSION_PREREQ(3, 4)
   if (enable_fips_indicator_events) {
     errors->push_back(
         "--enable-fips-indicator-events requires OpenSSL 3.4 or later");
   }
+
+  if (force_fips_crypto && force_fips_crypto_policy == "strict") {
+    errors->push_back("--force-fips=strict requires OpenSSL 3.4 or later");
+  }
 #endif
 
   // Any value less than 2 disables use of the secure heap.
@@ -1460,9 +1470,14 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             &PerProcessOptions::enable_fips_indicator_events,
             kAllowedInEnvvar);
   AddOption("--force-fips",
-            "force FIPS crypto (cannot be disabled)",
+            "force FIPS crypto (optional mode: provider or strict)",
             &PerProcessOptions::force_fips_crypto,
             kAllowedInEnvvar);
+  AddOption("[force_fips_crypto_policy]",
+            "",
+            &PerProcessOptions::force_fips_crypto_policy,
+            kAllowedInEnvvar);
+  AddAlias("--force-fips=", {"[force_fips_crypto_policy]", "--force-fips"});
 #ifndef V8_ENABLE_SANDBOX
   AddOption("--secure-heap",
             "total size of the OpenSSL secure heap",
@@ -2059,6 +2074,12 @@ void GetOptionsAsFlags(const FunctionCallbackInfo<Value>& args) {
     switch (option_info.type) {
       case kBoolean: {
         bool current_value = *_ppop_instance.Lookup<bool>(field, opts);
+#if HAVE_OPENSSL
+        if (option_name == "--force-fips" && current_value) {
+          flags.push_back(option_name + "=" + opts->force_fips_crypto_policy);
+          break;
+        }
+#endif
         // For boolean options with default_is_true, we want the opposite logic
         if (option_info.default_is_true) {
           if (!current_value) {

src/node_options.h

@@ -373,6 +373,7 @@ class PerProcessOptions : public Options {
   bool enable_fips_crypto = false;
   bool enable_fips_indicator_events = false;
   bool force_fips_crypto = false;
+  std::string force_fips_crypto_policy = "provider";
 #endif
 #if OPENSSL_VERSION_MAJOR >= 3
   bool openssl_legacy_provider = false;