Skip to content

Commit

Permalink
tls: Use SHA1 for sessionIdContext in FIPS mode
Browse files Browse the repository at this point in the history
FIPS 140-2 disallows use of MD5, which is used to derive the
default sessionIdContext for tls.createServer().

PR-URL: #3755
Reviewed-By: Fedor Indutny <[email protected]>
  • Loading branch information
stefanmb authored and jasnell committed Dec 17, 2015
1 parent f28f69d commit 0eb0119
Show file tree
Hide file tree
Showing 2 changed files with 18 additions and 4 deletions.
3 changes: 2 additions & 1 deletion doc/api/tls.markdown
Original file line number Diff line number Diff line change
Expand Up @@ -804,7 +804,8 @@ automatically set as a listener for the [secureConnection][] event. The

- `sessionIdContext`: A string containing an opaque identifier for session
resumption. If `requestCert` is `true`, the default is MD5 hash value
generated from command-line. Otherwise, the default is not provided.
generated from command-line. (In FIPS mode a truncated SHA1 hash is
used instead.) Otherwise, the default is not provided.

- `secureProtocol`: The SSL method to use, e.g. `SSLv3_method` to force
SSL version 3. The possible values depend on your installation of
Expand Down
19 changes: 16 additions & 3 deletions lib/_tls_wrap.js
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,21 @@ const Timer = process.binding('timer_wrap').Timer;
const tls_wrap = process.binding('tls_wrap');
const TCP = process.binding('tcp_wrap').TCP;
const Pipe = process.binding('pipe_wrap').Pipe;
const defaultSessionIdContext = getDefaultSessionIdContext();

function getDefaultSessionIdContext() {
var defaultText = process.argv.join(' ');
/* SSL_MAX_SID_CTX_LENGTH is 128 bits */
if (process.config.variables.openssl_fips) {

This comment has been minimized.

Copy link
@sneak

sneak Apr 7, 2016

this line errors out when using mocha/istanbul/supertest, because apparently process.config.variables is undefined. it doesn't happen on 4.2.3. it broke my app.

still happens on 4.4.2 (latest). (running latest supertest, 1.2.0)

ping @stefanmb @jasnell

PS: WTF is fips support being feature added to an LTS release for? This has cost me most of a workday because LTS is not supposed to be a moving target. 😦

krs_1 | > [email protected] test /var/app
krs_1 | > node ./node_modules/.bin/istanbul cover ./node_modules/mocha/bin/_mocha
krs_1 | 
krs_1 | No coverage information was collected, exit without writing coverage information
krs_1 | _tls_wrap.js:22
krs_1 |   if (process.config.variables.openssl_fips) {
krs_1 |                               ^
krs_1 | 
krs_1 | TypeError: Cannot read property 'openssl_fips' of undefined
krs_1 |   at getDefaultSessionIdContext (_tls_wrap.js:22:31)
krs_1 |   at _tls_wrap.js:17:33
krs_1 |   at NativeModule.compile (node.js:959:5)
krs_1 |   at NativeModule.require (node.js:904:18)
krs_1 |   at tls.js:221:21
krs_1 |   at NativeModule.compile (node.js:959:5)
krs_1 |   at NativeModule.require (node.js:904:18)
krs_1 |   at https.js:3:13
krs_1 |   at NativeModule.compile (node.js:959:5)
krs_1 |   at Function.NativeModule.require (node.js:904:18)
krs_1 |   at Function.Module._load (module.js:285:25)
krs_1 |   at Module.require (module.js:353:17)
krs_1 |   at require (internal/module.js:12:17)
krs_1 |   at Object.<anonymous> (/var/app/node_modules/supertest/node_modules/superagent/node_modules/form-data/lib/form_data.js:5:13)
krs_1 |   at Module._compile (module.js:409:26)
krs_1 |   at Object.Module._extensions..js (module.js:416:10)
krs_1 |   at Object.Module._extensions.(anonymous function) [as .js] (/var/app/node_modules/istanbul/lib/hook.js:109:37)
krs_1 |   at Module.load (/var/app/node_modules/coffee-script/lib/coffee-script/register.js:45:36)
krs_1 |   at Function.Module._load (module.js:300:12)
krs_1 |   at Module.require (module.js:353:17)
krs_1 |   at require (internal/module.js:12:17)
krs_1 |   at Object.<anonymous> (/var/app/node_modules/supertest/node_modules/superagent/lib/node/index.js:8:16)
krs_1 |   at Module._compile (module.js:409:26)
krs_1 |   at Object.Module._extensions..js (module.js:416:10)
krs_1 |   at Object.Module._extensions.(anonymous function) [as .js] (/var/app/node_modules/istanbul/lib/hook.js:109:37)
krs_1 |   at Module.load (/var/app/node_modules/coffee-script/lib/coffee-script/register.js:45:36)
krs_1 |   at Function.Module._load (module.js:300:12)
krs_1 |   at Module.require (module.js:353:17)
krs_1 |   at require (internal/module.js:12:17)
krs_1 |   at Object.<anonymous> (/var/app/node_modules/supertest/lib/test.js:5:15)
krs_1 |   at Module._compile (module.js:409:26)
krs_1 |   at Object.Module._extensions..js (module.js:416:10)
krs_1 |   at Object.Module._extensions.(anonymous function) [as .js] (/var/app/node_modules/istanbul/lib/hook.js:109:37)
krs_1 |   at Module.load (/var/app/node_modules/coffee-script/lib/coffee-script/register.js:45:36)
krs_1 |   at Function.Module._load (module.js:300:12)
krs_1 |   at Module.require (module.js:353:17)
krs_1 |   at require (internal/module.js:12:17)
krs_1 |   at Object.<anonymous> (/var/app/node_modules/supertest/index.js:7:12)
krs_1 |   at Module._compile (module.js:409:26)
krs_1 |   at Object.Module._extensions..js (module.js:416:10)
krs_1 |   at Object.Module._extensions.(anonymous function) [as .js] (/var/app/node_modules/istanbul/lib/hook.js:109:37)
krs_1 |   at Module.load (/var/app/node_modules/coffee-script/lib/coffee-script/register.js:45:36)
krs_1 |   at Function.Module._load (module.js:300:12)
krs_1 |   at Module.require (module.js:353:17)
krs_1 |   at require (internal/module.js:12:17)
krs_1 |   at Object.<anonymous> (/var/app/node_modules/supertest-as-promised/index.js:3:17)
krs_1 |   at Module._compile (module.js:409:26)
krs_1 |   at Object.Module._extensions..js (module.js:416:10)
krs_1 |   at Object.Module._extensions.(anonymous function) [as .js] (/var/app/node_modules/istanbul/lib/hook.js:109:37)
krs_1 |   at Module.load (/var/app/node_modules/coffee-script/lib/coffee-script/register.js:45:36)
krs_1 |   at Function.Module._load (module.js:300:12)
krs_1 |   at Module.require (module.js:353:17)
krs_1 |   at require (internal/module.js:12:17)
krs_1 |   at Object.<anonymous> (/var/app/test/app.coffee:3:11)
krs_1 |   at Object.<anonymous> (/var/app/test/app.coffee:2:1)
krs_1 |   at Module._compile (module.js:409:26)
krs_1 |   at Object.loadFile (/var/app/node_modules/coffee-script/lib/coffee-script/register.js:16:19)
krs_1 |   at Module.load (/var/app/node_modules/coffee-script/lib/coffee-script/register.js:45:36)
krs_1 |   at Function.Module._load (module.js:300:12)
krs_1 |   at Module.require (module.js:353:17)
krs_1 |   at require (internal/module.js:12:17)
krs_1 |   at /var/app/node_modules/mocha/lib/mocha.js:219:27
krs_1 |   at Array.forEach (native)
krs_1 |   at Mocha.loadFiles (/var/app/node_modules/mocha/lib/mocha.js:216:14)
krs_1 |   at Mocha.run (/var/app/node_modules/mocha/lib/mocha.js:468:10)
krs_1 |   at Object.<anonymous> (/var/app/node_modules/mocha/bin/_mocha:403:18)
krs_1 |   at Module._compile (module.js:409:26)
krs_1 |   at Object.Module._extensions..js (module.js:416:10)
krs_1 |   at Object.Module._extensions.(anonymous function) [as .js] (/var/app/node_modules/istanbul/lib/hook.js:109:37)
krs_1 |   at Module.load (module.js:343:32)
krs_1 |   at Function.Module._load (module.js:300:12)
krs_1 |   at Function.Module.runMain (module.js:441:10)
krs_1 |   at runFn (/var/app/node_modules/istanbul/lib/command/common/run-with-cover.js:122:16)
krs_1 |   at /var/app/node_modules/istanbul/lib/command/common/run-with-cover.js:251:17
krs_1 |   at /var/app/node_modules/istanbul/lib/util/file-matcher.js:68:16
krs_1 |   at /var/app/node_modules/istanbul/node_modules/async/lib/async.js:52:16
krs_1 |   at /var/app/node_modules/istanbul/node_modules/async/lib/async.js:361:13
krs_1 |   at /var/app/node_modules/istanbul/node_modules/async/lib/async.js:52:16
krs_1 |   at done (/var/app/node_modules/istanbul/node_modules/async/lib/async.js:246:17)
krs_1 |   at /var/app/node_modules/istanbul/node_modules/async/lib/async.js:44:16
krs_1 |   at /var/app/node_modules/istanbul/node_modules/async/lib/async.js:358:17
krs_1 |   at LOOP (fs.js:1530:14)
krs_1 |   at nextTickCallbackWith0Args (node.js:420:9)
krs_1 |   at process._tickCallback (node.js:349:13)
return crypto.createHash('sha1')
.update(defaultText)
.digest('hex').slice(0, 32);
} else {
return crypto.createHash('md5')
.update(defaultText)
.digest('hex');
}
}

function onhandshakestart() {
debug('onhandshakestart');
Expand Down Expand Up @@ -872,9 +887,7 @@ Server.prototype.setOptions = function(options) {
if (options.sessionIdContext) {
this.sessionIdContext = options.sessionIdContext;
} else {
this.sessionIdContext = crypto.createHash('md5')
.update(process.argv.join(' '))
.digest('hex');
this.sessionIdContext = defaultSessionIdContext;
}
};

Expand Down

0 comments on commit 0eb0119

Please sign in to comment.