[v10.x] tls: support TLS min/max protocol defaults in CLI #27946

sam-github · 2019-05-29T08:12:45Z

See #27666 and #27432 (comment)

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
documentation is changed or added
commit message follows commit guidelines

sam-github · 2019-05-29T08:13:16Z

/cc @nodejs/lts

doc/api/cli.md

nodejs-github-bot · 2019-06-07T13:42:50Z

CI: https://ci.nodejs.org/job/node-test-pull-request/23694/

BethGriggs · 2019-06-07T14:57:17Z

Latest CI shows a relevant failure https://ci.nodejs.org/job/node-test-commit-linux-containered/nodes=ubuntu1604_sharedlibs_openssl110_x64/

not ok 1812 parallel/test-tls-cli-min-version-1.1
14:47:18   ---
14:47:18   duration_ms: 0.419
14:47:18   severity: fail
14:47:18   exitcode: 1
14:47:18   stack: |-
14:47:18     test: U U U U U SSLv2_method expect U U ERR_TLS_INVALID_PROTOCOL_METHOD
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:108:1)
14:47:18     client undefined
14:47:18     server SSLv2 methods disabled
14:47:18     test: U U U U U SSLv3_method expect U U ERR_TLS_INVALID_PROTOCOL_METHOD
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:110:1)
14:47:18     client undefined
14:47:18     server SSLv3 methods disabled
14:47:18     test: U U U U U hokey-pokey expect U U ERR_TLS_INVALID_PROTOCOL_METHOD
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:118:1)
14:47:18     client undefined
14:47:18     server Unknown method
14:47:18     test: U U U U TLSv1.2 TLS1_2_method expect U U ERR_TLS_PROTOCOL_VERSION_CONFLICT
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:122:1)
14:47:18     client undefined
14:47:18     server ERR_TLS_PROTOCOL_VERSION_CONFLICT
14:47:18     test: U U U TLSv1.2 U TLS1_2_method expect U U ERR_TLS_PROTOCOL_VERSION_CONFLICT
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:124:1)
14:47:18     client undefined
14:47:18     server ERR_TLS_PROTOCOL_VERSION_CONFLICT
14:47:18     test: U U SSLv2_method U U U expect U ERR_TLS_INVALID_PROTOCOL_METHOD U
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:112:1)
14:47:18     client SSLv2 methods disabled
14:47:18     server undefined
14:47:18     test: U U SSLv3_method U U U expect U ERR_TLS_INVALID_PROTOCOL_METHOD U
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:114:1)
14:47:18     client SSLv3 methods disabled
14:47:18     server undefined
14:47:18     test: U U hokey-pokey U U U expect U ERR_TLS_INVALID_PROTOCOL_METHOD U
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:116:1)
14:47:18     client Unknown method
14:47:18     server undefined
14:47:18     test: U TLSv1.2 TLS1_2_method U U U expect U ERR_TLS_PROTOCOL_VERSION_CONFLICT U
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:126:1)
14:47:18     client ERR_TLS_PROTOCOL_VERSION_CONFLICT
14:47:18     server undefined
14:47:18     test: TLSv1.2 U TLS1_2_method U U U expect U ERR_TLS_PROTOCOL_VERSION_CONFLICT U
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:128:1)
14:47:18     client ERR_TLS_PROTOCOL_VERSION_CONFLICT
14:47:18     server undefined
14:47:18     test: U U TLSv1_method U U SSLv23_method expect U ECONNRESET ERR_SSL_UNSUPPORTED_PROTOCOL
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:156:3)
14:47:18     client ECONNRESET
14:47:18     server ERR_SSL_UNSUPPORTED_PROTOCOL
14:47:18     test: U U TLSv1_method U U U expect U ECONNRESET ERR_SSL_UNSUPPORTED_PROTOCOL
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:196:3)
14:47:18     client ECONNRESET
14:47:18     server ERR_SSL_UNSUPPORTED_PROTOCOL
14:47:18     test: U U SSLv23_method U U TLSv1_method expect U ERR_SSL_UNSUPPORTED_PROTOCOL ERR_SSL_WRONG_VERSION_NUMBER
14:47:18         (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:159:3)
14:47:18     client 139923555178304:error:1417118C:SSL routines:tls_process_server_hello:version too low:ssl/statem/statem_clnt.c:932:
14:47:18     
14:47:18     server ERR_SSL_WRONG_VERSION_NUMBER
14:47:18     assert.js:84
14:47:18       throw new AssertionError(obj);
14:47:18       ^
14:47:18     
14:47:18     AssertionError [ERR_ASSERTION]: Input A expected to strictly equal input B:
14:47:18     + expected - actual
14:47:18     
14:47:18     - '139923555178304:error:1417118C:SSL routines:tls_process_server_hello:version too low:ssl/statem/statem_clnt.c:932:\n'
14:47:18     + 'ERR_SSL_UNSUPPORTED_PROTOCOL'
14:47:18         at common.mustCall (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:82:16)
14:47:18         at /home/iojs/build/workspace/node-test-commit-linux-containered/test/common/index.js:379:15
14:47:18         at /home/iojs/build/workspace/node-test-commit-linux-containered/test/common/index.js:379:15
14:47:18         at maybeCallback (/home/iojs/build/workspace/node-test-commit-linux-containered/test/fixtures/tls-connect.js:97:7)
14:47:18         at Server.<anonymous> (/home/iojs/build/workspace/node-test-commit-linux-containered/test/fixtures/tls-connect.js:84:7)
14:47:18         at Server.emit (events.js:198:13)
14:47:18         at TLSSocket.onSocketTLSError (_tls_wrap.js:751:29)
14:47:18         at TLSSocket.emit (events.js:198:13)
14:47:18         at TLSSocket._tlsError (_tls_wrap.js:615:8)
14:47:18         at TLSSocket.emit (events.js:198:13)
14:47:18   ...

sam-github · 2019-06-07T18:25:02Z

Strangely, I could repro when I built against external openssl 1.1.0j. I'll have to do more digging to see what CI is doing. EDIT: I meant could not repro

sam-github · 2019-06-07T19:24:51Z

I'm trying to verify what version of OpenSSL 1.1.0 was used in the failed job above. @richardlau do you know how I would work through the build system to find out?

I tried checking the workspace, https://ci.nodejs.org/job/node-test-commit-linux-containered/nodes=ubuntu1604_sharedlibs_openssl110_x64/ws/config.gypi/*view*/, but the include_dirs in config.gypi don't appear to contain an external openssl path, and config.status doesn't show signs of --shared-openssl being used, so that workspace is probably not what I think.

If its a docker container, I should be able to run it on my laptop, and repro the build.

@richardlau do you have any suggestions on how to find the docker container, or any information on how the docker container is configured?

richardlau · 2019-06-07T22:38:30Z

@sam-github Walking through the links from https://ci.nodejs.org/job/node-test-pull-request/23694/ the full console log of the failing build being referenced is https://ci.nodejs.org/job/node-test-commit-linux-containered/13265/nodes=ubuntu1604_sharedlibs_openssl110_x64/consoleFull

python ./configure --verbose  --shared-openssl --shared-openssl-includes=/opt/openssl-1.1.0j/include/ --shared-openssl-libpath=/opt/openssl-1.1.0j/lib/

The docker container configuration is in the build repo: https://github.com/nodejs/build/blob/master/ansible/roles/docker/templates/ubuntu1604_sharedlibs.Dockerfile.j2

nodejs-github-bot · 2019-06-08T04:41:04Z

CI: https://ci.nodejs.org/job/node-test-pull-request/23709/

nodejs-github-bot · 2019-06-10T18:40:20Z

CI: https://ci.nodejs.org/job/node-test-pull-request/23765/

sam-github · 2019-06-10T19:44:45Z

Strangely, I just cannot reproduce this locally building against the same shared openssl version. I'm trying to build&run the docker image locally.

BethGriggs · 2020-02-24T20:14:49Z

@sam-github I've just cherry-picked some additional 'mark as flaky' commits on to v10.x-staging. Hopefully, CI will be better now 🤞

nodejs-github-bot · 2020-02-24T20:20:25Z

CI: https://ci.nodejs.org/job/node-test-pull-request/29322/

BethGriggs · 2020-02-24T21:47:08Z

Added #27500 to v10.x, hopefully, clears up the last error.

nodejs-github-bot · 2020-02-24T21:47:44Z

CI: https://ci.nodejs.org/job/node-test-pull-request/29327/ 🎉

Backport CLI switches for default TLS versions: - `--tls-max-v1.2` - `--tls-min-v1.0` - `--tls-min-v1.1` - `--tls-min-v1.2` PR-URL: #27946 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Beth Griggs <[email protected]> Reviewed-By: Shelley Vohr <[email protected]>

BethGriggs · 2020-02-25T00:13:31Z

Landed in 1cfb457

sam-github · 2020-02-25T00:40:33Z

Yay!

Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - deps: - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - upgrade npm to 6.13.7 (Michael Perrotte) [#31558](#31558) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) PR-URL: #31984

Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - deps: - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - upgrade npm to 6.13.7 (Michael Perrotte) [#31558](#31558) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) PR-URL: #31984

Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - deps: - update npm to 6.14.3 (Myles Borins) [#32368](#32368) - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) PR-URL: #31984

Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - deps: - update npm to 6.14.3 (Myles Borins) [#32368](#32368) - upgrade openssl sources to 1.1.1e (Hassaan Pasha) [#32328](#32328) - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) - url: handle quasi-WHATWG URLs in urlToOptions() (cjihrig) [#26226](#26226) PR-URL: #31984

Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - build: macOS package notarization (Rod Vagg) [#31459](#31459) - deps: - update npm to 6.14.3 (Myles Borins) [#32368](#32368) - upgrade openssl sources to 1.1.1e (Hassaan Pasha) [#32328](#32328) - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) - url: handle quasi-WHATWG URLs in urlToOptions() (cjihrig) [#26226](#26226) PR-URL: #31984

Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - build: macOS package notarization (Rod Vagg) [#31459](#31459) - deps: - update npm to 6.14.3 (Myles Borins) [#32368](#32368) - upgrade openssl sources to 1.1.1e (Hassaan Pasha) [#32328](#32328) - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - define release 6 [#32058](#32058) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) - url: handle quasi-WHATWG URLs in urlToOptions() (cjihrig) [#26226](#26226) PR-URL: #31984

macOS package notarization and a change in builder configuration The macOS binaries for this release, and future 10.x releases, are now being compiled on macOS 10.15 (Catalina) with Xcode 11 to support package notarization, a requirement for installing .pkg files on macOS 10.15 and later. Previous builds of Node.js 10.x were compiled on macOS 10.7 (Lion). As binaries are still being compiled to support a minimum of macOS 10.7 (Lion) we do not anticipate this having a negative impact on Node.js 10.x users with older versions of macOS. Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - build: macOS package notarization (Rod Vagg) [#31459](#31459) - deps: - update npm to 6.14.3 (Myles Borins) [#32368](#32368) - upgrade openssl sources to 1.1.1e (Hassaan Pasha) [#32328](#32328) - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - define release 6 [#32058](#32058) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) - url: handle quasi-WHATWG URLs in urlToOptions() (cjihrig) [#26226](#26226) PR-URL: #31984

macOS package notarization and a change in builder configuration The macOS binaries for this release, and future 10.x releases, are now being compiled on macOS 10.15 (Catalina) with Xcode 11 to support package notarization, a requirement for installing .pkg files on macOS 10.15 and later. Previous builds of Node.js 10.x were compiled on macOS 10.10 (Yosemite) with a minimum deployment target of macOS 10.7 (Lion). As binaries are still being compiled to support a minimum of macOS 10.7 (Lion) we do not anticipate this having a negative impact on Node.js 10.x users with older versions of macOS. Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - build: macOS package notarization (Rod Vagg) [#31459](#31459) - deps: - update npm to 6.14.3 (Myles Borins) [#32368](#32368) - upgrade openssl sources to 1.1.1e (Hassaan Pasha) [#32328](#32328) - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - define release 6 [#32058](#32058) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) - url: handle quasi-WHATWG URLs in urlToOptions() (cjihrig) [#26226](#26226) PR-URL: #31984

richardlau reviewed May 29, 2019

View reviewed changes

doc/api/cli.md Outdated Show resolved Hide resolved

mscdex added tls Issues and PRs related to the tls subsystem. v10.x labels May 29, 2019

addaleax changed the title ~~tls: support TLS min/max protocol defaults in CLI~~ [v10.x] tls: support TLS min/max protocol defaults in CLI May 29, 2019

addaleax approved these changes May 29, 2019

View reviewed changes

bnoordhuis approved these changes Jun 1, 2019

View reviewed changes

doc/api/cli.md Outdated Show resolved Hide resolved

sam-github force-pushed the tls-min-max-cli-v10.x branch from 5fb1f1a to b329d2a Compare June 4, 2019 19:00

This comment has been minimized.

Sign in to view

sam-github force-pushed the tls-min-max-cli-v10.x branch 3 times, most recently from a5884ed to 436b0dd Compare June 5, 2019 16:56

BethGriggs approved these changes Jun 6, 2019

View reviewed changes

This comment has been minimized.

Sign in to view

sam-github force-pushed the tls-min-max-cli-v10.x branch from 436b0dd to f269280 Compare June 7, 2019 17:33

codebytere approved these changes Jun 7, 2019

View reviewed changes

BethGriggs added the semver-minor PRs that contain new features and should be released in the next minor version. label Jun 28, 2019

sam-github mentioned this pull request Jul 23, 2019

tls.DEFAULT_MIN_VERSION according to docs is v11 feature, but its present in v10.16.0 and is incorrect #28758

Closed

This comment has been minimized.

Sign in to view

sam-github force-pushed the tls-min-max-cli-v10.x branch from 5854611 to d18c1e3 Compare September 4, 2019 15:44

This comment has been minimized.

Sign in to view

BethGriggs closed this Feb 25, 2020

sam-github deleted the tls-min-max-cli-v10.x branch February 25, 2020 00:40

BethGriggs removed the lts-watch-v10.x label Feb 27, 2020

BethGriggs mentioned this pull request Mar 12, 2020

v10.20.0 proposal #31984

Merged

BethGriggs mentioned this pull request Feb 17, 2022

Expose a way to specify TLS version by node command line #27666

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[v10.x] tls: support TLS min/max protocol defaults in CLI #27946

[v10.x] tls: support TLS min/max protocol defaults in CLI #27946

sam-github commented May 29, 2019

sam-github commented May 29, 2019

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

nodejs-github-bot commented Jun 7, 2019

BethGriggs commented Jun 7, 2019

sam-github commented Jun 7, 2019 •

edited

Loading

sam-github commented Jun 7, 2019

richardlau commented Jun 7, 2019

nodejs-github-bot commented Jun 8, 2019

nodejs-github-bot commented Jun 10, 2019

sam-github commented Jun 10, 2019

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

BethGriggs commented Feb 24, 2020 •

edited

Loading

This comment has been minimized.

nodejs-github-bot commented Feb 24, 2020

BethGriggs commented Feb 24, 2020

nodejs-github-bot commented Feb 24, 2020 •

edited by BethGriggs

Loading

BethGriggs commented Feb 25, 2020

sam-github commented Feb 25, 2020

[v10.x] tls: support TLS min/max protocol defaults in CLI #27946

[v10.x] tls: support TLS min/max protocol defaults in CLI #27946

Conversation

sam-github commented May 29, 2019

Checklist

sam-github commented May 29, 2019

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

nodejs-github-bot commented Jun 7, 2019

BethGriggs commented Jun 7, 2019

sam-github commented Jun 7, 2019 • edited Loading

sam-github commented Jun 7, 2019

richardlau commented Jun 7, 2019

nodejs-github-bot commented Jun 8, 2019

nodejs-github-bot commented Jun 10, 2019

sam-github commented Jun 10, 2019

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

BethGriggs commented Feb 24, 2020 • edited Loading

This comment has been minimized.

nodejs-github-bot commented Feb 24, 2020

BethGriggs commented Feb 24, 2020

nodejs-github-bot commented Feb 24, 2020 • edited by BethGriggs Loading

BethGriggs commented Feb 25, 2020

sam-github commented Feb 25, 2020

sam-github commented Jun 7, 2019 •

edited

Loading

BethGriggs commented Feb 24, 2020 •

edited

Loading

nodejs-github-bot commented Feb 24, 2020 •

edited by BethGriggs

Loading