mirror of
https://github.com/nodejs/node.git
synced 2026-10-28 18:25:13 +08:00
Filip Skokan
9b5d938fad
Run supported DH, ECDH, legacy TLS, TLS 1.2 PSK, cipher metadata, raw key, and X.509 date cases with BoringSSL. Assert its DH flags, curve format errors, and name-constraint behavior. Narrow key/cert array exclusions to the failing multi-identity cases. Use modp5 for the DH group setter checks and remove the unused legacy protocol fallback helper. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: https://github.com/nodejs/node/pull/66922 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
85 lines
2.5 KiB
JavaScript
85 lines
2.5 KiB
JavaScript
'use strict';
|
|
const common = require('../common');
|
|
if (!common.hasCrypto)
|
|
common.skip('missing crypto');
|
|
|
|
const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
|
|
|
|
// This test ensures that `getProtocol` returns the right protocol
|
|
// from a TLS connection
|
|
|
|
const assert = require('assert');
|
|
const tls = require('tls');
|
|
const fixtures = require('../common/fixtures');
|
|
const fips3 = hasFIPS(3);
|
|
|
|
const clientConfigs = [
|
|
{
|
|
secureProtocol: 'TLSv1_method',
|
|
version: 'TLSv1',
|
|
ciphers: (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT')
|
|
}, {
|
|
secureProtocol: 'TLSv1_1_method',
|
|
version: 'TLSv1.1',
|
|
ciphers: (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT')
|
|
}, {
|
|
secureProtocol: 'TLSv1_2_method',
|
|
version: 'TLSv1.2'
|
|
},
|
|
];
|
|
|
|
const serverConfig = {
|
|
// BoringSSL's library default minimum is TLSv1.2, so enable legacy versions
|
|
// explicitly instead of relying on TLS_method's default minimum.
|
|
...(isBoringSSL ? { minVersion: 'TLSv1' } : { secureProtocol: 'TLS_method' }),
|
|
key: fixtures.readKey('agent2-key.pem'),
|
|
cert: fixtures.readKey('agent2-cert.pem')
|
|
};
|
|
|
|
serverConfig.ciphers = fips3 ?
|
|
'ECDHE-RSA-AES256-GCM-SHA384' : isBoringSSL ? 'RSA' : 'RSA@SECLEVEL=0';
|
|
|
|
const expectedConnections = fips3 ? 1 : clientConfigs.length;
|
|
const server = tls.createServer(serverConfig, common.mustCall(expectedConnections));
|
|
|
|
if (fips3) {
|
|
server.on('tlsClientError', common.mustCall((err) => {
|
|
assert.ok([
|
|
'ERR_SSL_NO_SUITABLE_DIGEST_ALGORITHM',
|
|
'ERR_SSL_UNEXPECTED_MESSAGE',
|
|
].includes(err.code), err);
|
|
}, 2));
|
|
}
|
|
|
|
server
|
|
.listen(0, common.localhostIPv4, common.mustCall(function() {
|
|
let completed = 0;
|
|
function done() {
|
|
if (++completed === clientConfigs.length)
|
|
server.close();
|
|
}
|
|
|
|
for (const v of clientConfigs) {
|
|
const shouldConnect = !fips3 || v.version === 'TLSv1.2';
|
|
const client = tls.connect({
|
|
host: common.localhostIPv4,
|
|
port: server.address().port,
|
|
ciphers: v.ciphers,
|
|
rejectUnauthorized: false,
|
|
secureProtocol: v.secureProtocol
|
|
}, shouldConnect ? common.mustCall(function() {
|
|
assert.strictEqual(this.getProtocol(), v.version);
|
|
this.on('end', common.mustCall());
|
|
this.on('close', common.mustCall(function() {
|
|
assert.strictEqual(this.getProtocol(), null);
|
|
done();
|
|
})).end();
|
|
}) : common.mustNotCall());
|
|
|
|
if (!shouldConnect) {
|
|
client.on('error', common.mustCall((err) => assert(err.code)));
|
|
client.on('close', common.mustCall(done));
|
|
}
|
|
}
|
|
}));
|