1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

tls: fix DEP0083 after upgrading to OpenSSL 1.1.0

Browse Source 
Setting ecdhCurve to false is already unsupported, so the deprecation
should already be EOL. The test was skipped ever since we upgraded to
OpenSSL 1.1.0.

PR-URL: https://github.com/nodejs/node/pull/22953
Refs: https://github.com/nodejs/node/pull/16130
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
This commit is contained in:
Tobias Nießen 2018-09-19 19:40:44 +02:00 committed by Daniel Bevenius
parent 2790db5e3d
commit 4da11f2dc5
4 changed files with 11 additions and 82 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
doc/api/deprecations.md
View File

@ -1648,17 +1648,20 @@ the `REPLServer` itself. Do not use this function.
### DEP0083: Disabling ECDH by setting ecdhCurve to false
<!-- YAML
changes:
- version: v10.0.0
pr-url: https://github.com/nodejs/node/pull/19794
description: End-of-Life.
- version: v9.2.0
pr-url: https://github.com/nodejs/node/pull/16130
description: Runtime deprecation.
-->
Type: Runtime
Type: End-of-Life.
The `ecdhCurve` option to `tls.createSecureContext()` and `tls.TLSSocket` could
be set to `false` to disable ECDH entirely on the server only. This mode is
be set to `false` to disable ECDH entirely on the server only. This mode was
deprecated in preparation for migrating to OpenSSL 1.1.0 and consistency with
the client. Use the `ciphers` parameter instead.
the client and is now unsupported. Use the `ciphers` parameter instead.
<a id="DEP0084"></a>
### DEP0084: requiring bundled internal dependencies

6
doc/api/tls.md
View File

@ -1007,6 +1007,10 @@ argument.
<!-- YAML
added: v0.11.13
changes:
- version: v10.0.0
pr-url: https://github.com/nodejs/node/pull/19794
description: The `ecdhCurve` cannot be set to `false` anymore due to a
change in OpenSSL.
- version: v9.3.0
pr-url: https://github.com/nodejs/node/pull/14903
description: The `options` parameter can now include `clientCertEngine`.
@ -1062,7 +1066,7 @@ changes:
discarded and DHE ciphers will not be available.
* `ecdhCurve` {string} A string describing a named curve or a colon separated
list of curve NIDs or names, for example `P-521:P-384:P-256`, to use for
ECDH key agreement, or `false` to disable ECDH. Set to `auto` to select the
ECDH key agreement. Set to `auto` to select the
curve automatically. Use [`crypto.getCurves()`][] to obtain a list of
available curve names. On recent releases, `openssl ecparam -list_curves`
will also display the name and description of each available elliptic curve.

12
lib/_tls_common.js
View File

@ -69,16 +69,6 @@ function validateKeyCert(name, value) {
exports.SecureContext = SecureContext;
function ecdhCurveWarning() {
if (ecdhCurveWarning.emitted) return;
process.emitWarning('{ ecdhCurve: false } is deprecated.',
'DeprecationWarning',
'DEP0083');
ecdhCurveWarning.emitted = true;
}
ecdhCurveWarning.emitted = false;
exports.createSecureContext = function createSecureContext(options, context) {
if (!options) options = {};
@ -154,8 +144,6 @@ exports.createSecureContext = function createSecureContext(options, context) {
c.context.setECDHCurve(tls.DEFAULT_ECDH_CURVE);
else if (options.ecdhCurve)
c.context.setECDHCurve(options.ecdhCurve);
else
ecdhCurveWarning();
if (options.dhparam) {
const warning = c.context.setDHParam(options.dhparam);

66
test/parallel/test-tls-ecdh-disable.js
View File

@ -1,66 +0,0 @@
// Copyright Joyent, Inc. and other Node contributors.
//
// Permission is hereby granted, free of charge, to any person obtaining a
// copy of this software and associated documentation files (the
// "Software"), to deal in the Software without restriction, including
// without limitation the rights to use, copy, modify, merge, publish,
// distribute, sublicense, and/or sell copies of the Software, and to permit
// persons to whom the Software is furnished to do so, subject to the
// following conditions:
//
// The above copyright notice and this permission notice shall be included
// in all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
// USE OR OTHER DEALINGS IN THE SOFTWARE.
// Test that the usage of elliptic curves are not permitted if disabled during
// server initialization.
'use strict';
const common = require('../common');
const { readKey } = require('../common/fixtures');
if (!common.hasCrypto)
common.skip('missing crypto');
if (!common.opensslCli)
common.skip('missing openssl-cli');
const OPENSSL_VERSION_NUMBER =
require('crypto').constants.OPENSSL_VERSION_NUMBER;
if (OPENSSL_VERSION_NUMBER >= 0x10100000)
common.skip('false ecdhCurve not supported in OpenSSL 1.1.0');
const assert = require('assert');
const tls = require('tls');
const exec = require('child_process').exec;
const options = {
key: readKey('agent2-key.pem'),
cert: readKey('agent2-cert.pem'),
ciphers: 'ECDHE-RSA-AES128-SHA',
ecdhCurve: false
};
common.expectWarning('DeprecationWarning',
'{ ecdhCurve: false } is deprecated.',
'DEP0083');
const server = tls.createServer(options, common.mustNotCall());
server.listen(0, '127.0.0.1', common.mustCall(function() {
const cmd = `"${common.opensslCli}" s_client -cipher ${
options.ciphers} -connect 127.0.0.1:${this.address().port}`;
exec(cmd, common.mustCall(function(err, stdout, stderr) {
// Old versions of openssl will still exit with 0 so we
// can't just check if err is not null.
assert(stderr.includes('handshake failure'));
server.close();
}));
}));