tls: disallow conflicting TLS protocol options

Do not allow the minimum protocol level to be set higher than the max protocol level. See: #26951, 109c097 PR-URL: #27521 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]> Reviewed-By: Rich Trott <[email protected]>
nodejs · May 4, 2019 · 7bbf951 · 7bbf951
1 parent 014a9fd
commit 7bbf951
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/src/node_options.cc b/src/node_options.cc
@@ -148,6 +148,11 @@ void EnvironmentOptions::CheckOptions(std::vector<std::string>* errors) {
     errors->push_back("invalid value for --unhandled-rejections");
   }
 
+  if (tls_min_v1_3 && tls_max_v1_2) {
+    errors->push_back("either --tls-min-v1.3 or --tls-max-v1.2 can be "
+                      "used, not both");
+  }
+
 #if HAVE_INSPECTOR
   if (!cpu_prof) {
     if (!cpu_prof_name.empty()) {

diff --git a/test/parallel/test-tls-cli-min-max-conflict.js b/test/parallel/test-tls-cli-min-max-conflict.js
@@ -0,0 +1,14 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto) common.skip('missing crypto');
+
+// Check that conflicting TLS protocol versions are not allowed
+
+const assert = require('assert');
+const child_process = require('child_process');
+
+const args = ['--tls-min-v1.3', '--tls-max-v1.2', '-p', 'process.version'];
+child_process.execFile(process.argv[0], args, (err) => {
+  assert(err);
+  assert(/not both/.test(err.message));
+});