mirror of
https://github.com/nodejs/node.git
synced 2026-10-28 10:15:07 +08:00
Filip Skokan
a2ce2c6def
Use BoringSSL 0.20261020.0 for shared-library builds and expose the package wrapper's version to the matrix updater. The new verifier no longer emits UNABLE_TO_VERIFY_LEAF_SIGNATURE after Node's verification callback accepts a missing-issuer error. Expect UNABLE_TO_GET_ISSUER_CERT_LOCALLY for the affected leaf certificates and suggest --use-system-ca for that error. Drop the SSL_get_server_tmp_key() fallback now that BoringSSL supplies SSL_get_peer_tmp_key() as a compatibility stub. Refs: https://boringssl-review.googlesource.com/c/boringssl/+/103849 Refs: https://github.com/electron/electron/pull/55110/changes/b457e70e339e8bb3066b210edfb6f96582cdb374 Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: https://github.com/nodejs/node/pull/66922 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
58 lines
1.8 KiB
JavaScript
58 lines
1.8 KiB
JavaScript
// This tests that when the TLS handshake with the endpoint fails,
|
|
// the proxy client will get a connection error.
|
|
import * as common from '../common/index.mjs';
|
|
|
|
import fixtures from '../common/fixtures.js';
|
|
import assert from 'node:assert';
|
|
import { once } from 'events';
|
|
import { runProxiedRequest, createProxyServer } from '../common/proxy-server.js';
|
|
|
|
if (!common.hasCrypto)
|
|
common.skip('missing crypto');
|
|
|
|
// https must be dynamically imported so that builds without crypto support
|
|
// can skip it.
|
|
const { default: https } = await import('node:https');
|
|
const { untrustedLeafErrorCode } = await import('../common/tls.js');
|
|
|
|
const server = https.createServer({
|
|
cert: fixtures.readKey('agent8-cert.pem'),
|
|
key: fixtures.readKey('agent8-key.pem'),
|
|
}, common.mustNotCall());
|
|
server.on('error', common.mustNotCall((err) => { console.error('Server error', err); }));
|
|
server.listen(0);
|
|
await once(server, 'listening');
|
|
|
|
// Start a proxy server that sends incomplete headers.
|
|
const { proxy, logs } = createProxyServer();
|
|
proxy.listen(0);
|
|
await once(proxy, 'listening');
|
|
|
|
const serverHost = `localhost:${server.address().port}`;
|
|
const requestUrl = `https://${serverHost}/test`;
|
|
|
|
const { code, signal, stderr, stdout } = await runProxiedRequest({
|
|
NODE_USE_ENV_PROXY: 1,
|
|
REQUEST_URL: requestUrl,
|
|
HTTPS_PROXY: `http://localhost:${proxy.address().port}`,
|
|
});
|
|
|
|
// The proxy client should report the untrusted leaf during the TLS handshake.
|
|
assert.match(stderr, new RegExp(untrustedLeafErrorCode));
|
|
assert.strictEqual(stdout, '');
|
|
assert.strictEqual(code, 0);
|
|
assert.strictEqual(signal, null);
|
|
|
|
// Verify that it goes through the proxy.
|
|
assert.deepStrictEqual(logs, [{
|
|
method: 'CONNECT',
|
|
url: serverHost,
|
|
headers: {
|
|
'proxy-connection': 'keep-alive',
|
|
'host': serverHost,
|
|
},
|
|
}]);
|
|
|
|
proxy.close();
|
|
server.close();
|