1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

tls: cleanup onhandshakestart callback

Browse Source 
Re-arrange and cleanup the flow of the onhandshakestart to be
more clear and less repetitive. Exit early in the case of a
first ever handshake for a given connection.

PR-URL: https://github.com/nodejs/node/pull/20466
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
This commit is contained in:
Anatoli Papirovski 2018-05-02 12:49:13 +02:00
parent 9a3ae2fe9d
commit 491ae12e41
No known key found for this signature in database
GPG Key ID: 614E2E1ABEB4B2C0
1 changed files with 16 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
lib/_tls_wrap.js
View File

@ -62,33 +62,29 @@ const noop = () => {};
function onhandshakestart(now) { function onhandshakestart(now) {
debug('onhandshakestart'); debug('onhandshakestart');
assert(now >= this.lastHandshakeTime); const { lastHandshakeTime } = this;
assert(now >= lastHandshakeTime);
const owner = this.owner;
if ((now - this.lastHandshakeTime) >= tls.CLIENT_RENEG_WINDOW * 1000) {
this.handshakes = 0;
}
const first = (this.lastHandshakeTime === 0);
this.lastHandshakeTime = now; this.lastHandshakeTime = now;
if (first) return;
if (++this.handshakes > tls.CLIENT_RENEG_LIMIT) { // If this is the first handshake we can skip the rest of the checks.
// Defer the error event to the next tick. We're being called from OpenSSL's if (lastHandshakeTime === 0)
// state machine and OpenSSL is not re-entrant. We cannot allow the user's return;
// callback to destroy the connection right now, it would crash and burn.
setImmediate(emitSessionAttackError, owner); if ((now - lastHandshakeTime) >= tls.CLIENT_RENEG_WINDOW * 1000)
this.handshakes = 1;
else
this.handshakes++;
const { owner } = this;
if (this.handshakes > tls.CLIENT_RENEG_LIMIT) {
owner._emitTLSError(new ERR_TLS_SESSION_ATTACK());
return;
} }
if (owner[kDisableRenegotiation] && this.handshakes > 0) { if (owner[kDisableRenegotiation])
owner._emitTLSError(new ERR_TLS_RENEGOTIATION_DISABLED()); owner._emitTLSError(new ERR_TLS_RENEGOTIATION_DISABLED());
} }
}
function emitSessionAttackError(socket) {
socket._emitTLSError(new ERR_TLS_SESSION_ATTACK());
}
function onhandshakedone() { function onhandshakedone() {
debug('onhandshakedone'); debug('onhandshakedone');