node/test/common/boringssl.js

/* eslint-disable node-core/crypto-check */

'use strict';
const common = require('../common');
const assert = require('assert');
const fixtures = require('../common/fixtures');
const tls = require('tls');

// This module is for BoringSSL-specific branches in tests whose original
// OpenSSL coverage cannot run unchanged. Each helper should assert the
// observable BoringSSL behavior that explains why the OpenSSL-specific
// assertions are bypassed.

/**
 * BoringSSL exposes many removed or disabled TLS cipher suites as "no match"
 * at secure-context creation time. This is used for suites such as
 * finite-field DHE and anonymous ECDH that OpenSSL builds may still negotiate
 * in tests.
 * @param {Function} fn
 */
function assertNoCipherMatch(fn) {
  assert.throws(fn, {
    code: 'ERR_SSL_NO_CIPHER_MATCH',
    library: 'SSL routines',
    function: 'OPENSSL_internal',
    reason: 'NO_CIPHER_MATCH',
  });
}

/**
 * BoringSSL does not parse OpenSSL cipher-string commands such as `@SECLEVEL`.
 * Those are OpenSSL policy directives, not cipher names.
 * @param {Function} fn
 */
function assertInvalidCommand(fn) {
  assert.throws(fn, {
    code: 'ERR_SSL_INVALID_COMMAND',
    library: 'SSL routines',
    function: 'OPENSSL_internal',
    reason: 'INVALID_COMMAND',
  });
}

/**
 * Node's DHE tests exercise OpenSSL's finite-field DHE cipher support and DH
 * parameter-size policy. BoringSSL does not offer these DHE cipher suites on
 * this surface, so creating a server context with a DHE-only cipher list fails
 * before a handshake can test DH parameter behavior.
 */
function assertFiniteFieldDheUnsupported() {
  assertNoCipherMatch(() => {
    tls.createServer({
      key: fixtures.readKey('agent2-key.pem'),
      cert: fixtures.readKey('agent2-cert.pem'),
      ciphers: 'DHE-RSA-AES128-GCM-SHA256',
    });
  });
}

/**
 * OpenSSL security levels reject small keys by policy and can be adjusted with
 * `@SECLEVEL` in the cipher string. BoringSSL does not implement those security
 * levels: the small-key server context is accepted, while the OpenSSL-specific
 * `@SECLEVEL` command is rejected as invalid cipher-string syntax.
 */
function assertOpenSSLSecurityLevelsUnsupported() {
  const options = {
    key: fixtures.readKey('agent11-key.pem'),
    cert: fixtures.readKey('agent11-cert.pem'),
    ciphers: 'DEFAULT',
  };

  tls.createServer(options).close();

  options.ciphers = 'DEFAULT:@SECLEVEL=0';
  assertInvalidCommand(() => tls.createServer(options));
}

/**
 * Node's multi-key tests rely on OpenSSL accepting an array of private keys and
 * matching them with an array of certificates. BoringSSL rejects this mixed
 * EC/RSA identity configuration while configuring the certificate chain, before
 * a client can negotiate either identity.
 */
function assertMultiKeyUnsupported() {
  assert.throws(() => {
    tls.createServer({
      key: [
        fixtures.readKey('ec10-key.pem'),
        fixtures.readKey('agent1-key.pem'),
      ],
      cert: [
        fixtures.readKey('agent1-cert.pem'),
        fixtures.readKey('ec10-cert.pem'),
      ],
    });
  }, {
    code: 'ERR_OSSL_X509_KEY_TYPE_MISMATCH',
    library: 'X.509 certificate routines',
    function: 'OPENSSL_internal',
    reason: 'KEY_TYPE_MISMATCH',
  });
}

/**
 * BoringSSL does not support caller-initiated renegotiation. Even on a TLS 1.2
 * connection, TLSSocket#renegotiate() returns false and the callback receives
 * Node's BoringSSL-specific unsupported-renegotiation error instead of
 * entering the native binding or exercising Node's renegotiation-limit logic.
 */
function testRenegotiationUnsupported() {
  const server = tls.createServer({
    key: fixtures.readKey('rsa_private.pem'),
    cert: fixtures.readKey('rsa_cert.crt'),
    maxVersion: 'TLSv1.2',
  }, (socket) => socket.resume());

  server.listen(0, common.mustCall(() => {
    const client = tls.connect({
      port: server.address().port,
      rejectUnauthorized: false,
      maxVersion: 'TLSv1.2',
    }, common.mustCall(() => {
      const ok = client.renegotiate({}, common.mustCall((err) => {
        assert.throws(() => { throw err; }, {
          code: 'ERR_TLS_RENEGOTIATION_UNSUPPORTED',
          message: 'TLS session renegotiation is unsupported by this TLS ' +
                   'implementation',
        });
        client.destroy();
        server.close();
      }));
      assert.strictEqual(ok, false);
    }));
    client.on('error', common.mustNotCall());
  }));
}

/**
 * BoringSSL exposes the negotiated TLS group but not the ephemeral key size.
 */
function testEphemeralKeyInfo() {
  const server = tls.createServer({
    key: fixtures.readKey('agent2-key.pem'),
    cert: fixtures.readKey('agent2-cert.pem'),
    ciphers: 'ECDHE-RSA-AES256-GCM-SHA384',
    ecdhCurve: 'prime256v1',
    maxVersion: 'TLSv1.2',
  }, common.mustCall((socket) => {
    assert.strictEqual(socket.getEphemeralKeyInfo(), null);
    socket.end();
  }));

  server.listen(0, common.mustCall(() => {
    const client = tls.connect({
      port: server.address().port,
      rejectUnauthorized: false,
      maxVersion: 'TLSv1.2',
    }, common.mustCall(() => {
      assert.deepStrictEqual(client.getEphemeralKeyInfo(), {
        type: 'TLSGroup',
        name: 'prime256v1',
        size: undefined,
      });
      server.close();
    }));
  }));
}

/**
 * BoringSSL can load a multi-PFX option well enough to serve the ECDSA
 * identity, but it does not provide the same OpenSSL multi-identity selection
 * behavior. After the ECDSA handshake succeeds, an RSA-only client fails with
 * no shared cipher instead of selecting the RSA identity from the same PFX list.
 */
function testMultiPfxSelectionDifference() {
  const server = tls.createServer({
    pfx: [
      {
        buf: fixtures.readKey('agent1.pfx'),
        passphrase: 'sample',
      },
      fixtures.readKey('ec.pfx'),
    ],
  }, common.mustCallAtLeast((socket) => socket.end(), 1));

  server.listen(0, common.mustCall(() => {
    const ecdsa = tls.connect(server.address().port, {
      ciphers: 'ECDHE-ECDSA-AES256-GCM-SHA384',
      maxVersion: 'TLSv1.2',
      rejectUnauthorized: false,
    }, common.mustCall(() => {
      assert.strictEqual(ecdsa.getCipher().name,
                         'ECDHE-ECDSA-AES256-GCM-SHA384');
      ecdsa.end();

      server.once('tlsClientError', common.mustCall((err) => {
        assert.strictEqual(err.code, 'ERR_SSL_NO_SHARED_CIPHER');
      }));
      const rsa = tls.connect(server.address().port, {
        ciphers: 'ECDHE-RSA-AES256-GCM-SHA384',
        maxVersion: 'TLSv1.2',
        rejectUnauthorized: false,
      }, common.mustNotCall());
      rsa.on('error', common.mustCall((err) => {
        assert.strictEqual(err.code, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE');
        server.close();
      }));
    }));
  }));
}

/**
 * PSK works for TLS 1.2 in BoringSSL, but Node's PSK tests also cover the
 * default TLS 1.3 path. In that path BoringSSL does not complete a certificate-
 * less PSK-only handshake through Node's current server setup: the server
 * reports NO_CERTIFICATE_SET and the client receives an internal-error alert.
 */
function testPskTls13Unsupported() {
  const key = Buffer.from('d731ef57be09e5204f0b205b60627028', 'hex');
  let gotClientError = false;
  let gotServerError = false;
  function maybeClose(server) {
    if (gotClientError && gotServerError)
      server.close();
  }

  const server = tls.createServer({
    ciphers: 'PSK+HIGH',
    pskCallback() { return key; },
  }, common.mustNotCall());

  server.once('tlsClientError', common.mustCall((err) => {
    assert.strictEqual(err.code, 'ERR_SSL_NO_CERTIFICATE_SET');
    gotServerError = true;
    maybeClose(server);
  }));

  server.listen(0, common.mustCall(() => {
    const client = tls.connect({
      port: server.address().port,
      ciphers: 'PSK+HIGH',
      checkServerIdentity() {},
      pskCallback() {
        return { psk: key, identity: 'TestUser' };
      },
    }, common.mustNotCall());
    client.on('error', common.mustCall((err) => {
      assert.strictEqual(err.code, 'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR');
      gotClientError = true;
      maybeClose(server);
    }));
  }));
}

/**
 * The OpenSSL ticket tests assume that once a TLS 1.3 session is reused, the
 * client will not necessarily receive a replacement session event before close.
 * BoringSSL emits new session tickets on both the initial and resumed TLS 1.3
 * connections, so the resumed connection still emits at least one 'session'
 * event while isSessionReused() is true.
 */
function testTls13SessionTicketSemanticsDiffer() {
  const server = tls.createServer({
    key: fixtures.readKey('agent1-key.pem'),
    cert: fixtures.readKey('agent1-cert.pem'),
  }, (socket) => socket.end());

  let session;
  let secondSessionEvents = 0;

  server.listen(0, common.mustCall(() => {
    const first = tls.connect({
      port: server.address().port,
      rejectUnauthorized: false,
    }, common.mustCall(() => {
      assert.strictEqual(first.isSessionReused(), false);
    }));
    first.on('session', common.mustCallAtLeast((sess) => {
      session = sess;
    }, 1));
    first.on('close', common.mustCall(() => {
      assert(Buffer.isBuffer(session));

      const second = tls.connect({
        port: server.address().port,
        rejectUnauthorized: false,
        session,
      }, common.mustCall(() => {
        assert.strictEqual(second.isSessionReused(), true);
      }));
      second.on('session', common.mustCallAtLeast(() => {
        secondSessionEvents++;
      }, 1));
      second.on('close', common.mustCall(() => {
        assert(secondSessionEvents > 0);
        server.close();
      }));
      second.resume();
    }));
    first.resume();
  }));
}

module.exports = {
  assertFiniteFieldDheUnsupported,
  assertMultiKeyUnsupported,
  assertNoCipherMatch,
  assertOpenSSLSecurityLevelsUnsupported,
  testEphemeralKeyInfo,
  testMultiPfxSelectionDifference,
  testPskTls13Unsupported,
  testRenegotiationUnsupported,
  testTls13SessionTicketSemanticsDiffer,
};