[v10.x] tls: support TLS min/max protocol defaults in CLI by sam-github · Pull Request #27946 · nodejs/node

sam-github · 2019-05-29T08:12:45Z

See #27666 and #27432 (comment)

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
documentation is changed or added
commit message follows commit guidelines

sam-github · 2019-05-29T08:13:16Z

/cc @nodejs/lts

nodejs-github-bot · 2019-06-07T13:42:50Z

CI: https://ci.nodejs.org/job/node-test-pull-request/23694/

BethGriggs · 2019-06-07T14:57:17Z

Latest CI shows a relevant failure https://ci.nodejs.org/job/node-test-commit-linux-containered/nodes=ubuntu1604_sharedlibs_openssl110_x64/

not ok 1812 parallel/test-tls-cli-min-version-1.1
14:47:18 ---
14:47:18 duration_ms: 0.419
14:47:18 severity: fail
14:47:18 exitcode: 1
14:47:18 stack: |-
14:47:18 test: U U U U U SSLv2_method expect U U ERR_TLS_INVALID_PROTOCOL_METHOD
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:108:1)
14:47:18 client undefined
14:47:18 server SSLv2 methods disabled
14:47:18 test: U U U U U SSLv3_method expect U U ERR_TLS_INVALID_PROTOCOL_METHOD
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:110:1)
14:47:18 client undefined
14:47:18 server SSLv3 methods disabled
14:47:18 test: U U U U U hokey-pokey expect U U ERR_TLS_INVALID_PROTOCOL_METHOD
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:118:1)
14:47:18 client undefined
14:47:18 server Unknown method
14:47:18 test: U U U U TLSv1.2 TLS1_2_method expect U U ERR_TLS_PROTOCOL_VERSION_CONFLICT
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:122:1)
14:47:18 client undefined
14:47:18 server ERR_TLS_PROTOCOL_VERSION_CONFLICT
14:47:18 test: U U U TLSv1.2 U TLS1_2_method expect U U ERR_TLS_PROTOCOL_VERSION_CONFLICT
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:124:1)
14:47:18 client undefined
14:47:18 server ERR_TLS_PROTOCOL_VERSION_CONFLICT
14:47:18 test: U U SSLv2_method U U U expect U ERR_TLS_INVALID_PROTOCOL_METHOD U
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:112:1)
14:47:18 client SSLv2 methods disabled
14:47:18 server undefined
14:47:18 test: U U SSLv3_method U U U expect U ERR_TLS_INVALID_PROTOCOL_METHOD U
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:114:1)
14:47:18 client SSLv3 methods disabled
14:47:18 server undefined
14:47:18 test: U U hokey-pokey U U U expect U ERR_TLS_INVALID_PROTOCOL_METHOD U
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:116:1)
14:47:18 client Unknown method
14:47:18 server undefined
14:47:18 test: U TLSv1.2 TLS1_2_method U U U expect U ERR_TLS_PROTOCOL_VERSION_CONFLICT U
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:126:1)
14:47:18 client ERR_TLS_PROTOCOL_VERSION_CONFLICT
14:47:18 server undefined
14:47:18 test: TLSv1.2 U TLS1_2_method U U U expect U ERR_TLS_PROTOCOL_VERSION_CONFLICT U
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:128:1)
14:47:18 client ERR_TLS_PROTOCOL_VERSION_CONFLICT
14:47:18 server undefined
14:47:18 test: U U TLSv1_method U U SSLv23_method expect U ECONNRESET ERR_SSL_UNSUPPORTED_PROTOCOL
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:156:3)
14:47:18 client ECONNRESET
14:47:18 server ERR_SSL_UNSUPPORTED_PROTOCOL
14:47:18 test: U U TLSv1_method U U U expect U ECONNRESET ERR_SSL_UNSUPPORTED_PROTOCOL
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:196:3)
14:47:18 client ECONNRESET
14:47:18 server ERR_SSL_UNSUPPORTED_PROTOCOL
14:47:18 test: U U SSLv23_method U U TLSv1_method expect U ERR_SSL_UNSUPPORTED_PROTOCOL ERR_SSL_WRONG_VERSION_NUMBER
14:47:18 (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:159:3)
14:47:18 client 139923555178304:error:1417118C:SSL routines:tls_process_server_hello:version too low:ssl/statem/statem_clnt.c:932:
14:47:18 14:47:18 server ERR_SSL_WRONG_VERSION_NUMBER
14:47:18 assert.js:84
14:47:18 throw new AssertionError(obj);
14:47:18 ^
14:47:18 14:47:18 AssertionError [ERR_ASSERTION]: Input A expected to strictly equal input B:
14:47:18 + expected - actual
14:47:18 14:47:18 - '139923555178304:error:1417118C:SSL routines:tls_process_server_hello:version too low:ssl/statem/statem_clnt.c:932:\n'
14:47:18 + 'ERR_SSL_UNSUPPORTED_PROTOCOL'
14:47:18 at common.mustCall (/home/iojs/build/workspace/node-test-commit-linux-containered/test/parallel/test-tls-min-max-version.js:82:16)
14:47:18 at /home/iojs/build/workspace/node-test-commit-linux-containered/test/common/index.js:379:15
14:47:18 at /home/iojs/build/workspace/node-test-commit-linux-containered/test/common/index.js:379:15
14:47:18 at maybeCallback (/home/iojs/build/workspace/node-test-commit-linux-containered/test/fixtures/tls-connect.js:97:7)
14:47:18 at Server.<anonymous> (/home/iojs/build/workspace/node-test-commit-linux-containered/test/fixtures/tls-connect.js:84:7)
14:47:18 at Server.emit (events.js:198:13)
14:47:18 at TLSSocket.onSocketTLSError (_tls_wrap.js:751:29)
14:47:18 at TLSSocket.emit (events.js:198:13)
14:47:18 at TLSSocket._tlsError (_tls_wrap.js:615:8)
14:47:18 at TLSSocket.emit (events.js:198:13)
14:47:18 ...

sam-github · 2019-06-07T18:25:02Z

Strangely, I could repro when I built against external openssl 1.1.0j. I'll have to do more digging to see what CI is doing. EDIT: I meant could not repro

sam-github · 2019-06-07T19:24:51Z

I'm trying to verify what version of OpenSSL 1.1.0 was used in the failed job above. @richardlau do you know how I would work through the build system to find out?

I tried checking the workspace, https://ci.nodejs.org/job/node-test-commit-linux-containered/nodes=ubuntu1604_sharedlibs_openssl110_x64/ws/config.gypi/*view*/, but the include_dirs in config.gypi don't appear to contain an external openssl path, and config.status doesn't show signs of --shared-openssl being used, so that workspace is probably not what I think.

If its a docker container, I should be able to run it on my laptop, and repro the build.

@richardlau do you have any suggestions on how to find the docker container, or any information on how the docker container is configured?

richardlau · 2019-06-07T22:38:30Z

@sam-github Walking through the links from https://ci.nodejs.org/job/node-test-pull-request/23694/ the full console log of the failing build being referenced is https://ci.nodejs.org/job/node-test-commit-linux-containered/13265/nodes=ubuntu1604_sharedlibs_openssl110_x64/consoleFull

python ./configure --verbose --shared-openssl --shared-openssl-includes=/opt/openssl-1.1.0j/include/ --shared-openssl-libpath=/opt/openssl-1.1.0j/lib/

The docker container configuration is in the build repo: https://github.com/nodejs/build/blob/master/ansible/roles/docker/templates/ubuntu1604_sharedlibs.Dockerfile.j2

nodejs-github-bot · 2019-06-08T04:41:04Z

CI: https://ci.nodejs.org/job/node-test-pull-request/23709/

nodejs-github-bot · 2019-06-10T18:40:20Z

CI: https://ci.nodejs.org/job/node-test-pull-request/23765/

sam-github · 2019-06-10T19:44:45Z

Strangely, I just cannot reproduce this locally building against the same shared openssl version. I'm trying to build&run the docker image locally.

BethGriggs · 2020-02-24T20:14:49Z

@sam-github I've just cherry-picked some additional 'mark as flaky' commits on to v10.x-staging. Hopefully, CI will be better now 🤞

nodejs-github-bot · 2020-02-24T20:20:25Z

CI: https://ci.nodejs.org/job/node-test-pull-request/29322/

BethGriggs · 2020-02-24T21:47:08Z

Added #27500 to v10.x, hopefully, clears up the last error.

nodejs-github-bot · 2020-02-24T21:47:44Z

CI: https://ci.nodejs.org/job/node-test-pull-request/29327/ 🎉

Backport CLI switches for default TLS versions: - `--tls-max-v1.2` - `--tls-min-v1.0` - `--tls-min-v1.1` - `--tls-min-v1.2` PR-URL: #27946 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Shelley Vohr <codebytere@gmail.com>

BethGriggs · 2020-02-25T00:13:31Z

Landed in 1cfb457

sam-github · 2020-02-25T00:40:33Z

Yay!

Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - deps: - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - upgrade npm to 6.13.7 (Michael Perrotte) [#31558](#31558) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) PR-URL: #31984

Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - deps: - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - upgrade npm to 6.13.7 (Michael Perrotte) [#31558](#31558) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) PR-URL: #31984

Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - deps: - update npm to 6.14.3 (Myles Borins) [#32368](#32368) - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) PR-URL: #31984

Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - deps: - update npm to 6.14.3 (Myles Borins) [#32368](#32368) - upgrade openssl sources to 1.1.1e (Hassaan Pasha) [#32328](#32328) - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) - url: handle quasi-WHATWG URLs in urlToOptions() (cjihrig) [#26226](#26226) PR-URL: #31984

Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - build: macOS package notarization (Rod Vagg) [#31459](#31459) - deps: - update npm to 6.14.3 (Myles Borins) [#32368](#32368) - upgrade openssl sources to 1.1.1e (Hassaan Pasha) [#32328](#32328) - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) - url: handle quasi-WHATWG URLs in urlToOptions() (cjihrig) [#26226](#26226) PR-URL: #31984

Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - build: macOS package notarization (Rod Vagg) [#31459](#31459) - deps: - update npm to 6.14.3 (Myles Borins) [#32368](#32368) - upgrade openssl sources to 1.1.1e (Hassaan Pasha) [#32328](#32328) - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - define release 6 [#32058](#32058) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) - url: handle quasi-WHATWG URLs in urlToOptions() (cjihrig) [#26226](#26226) PR-URL: #31984

macOS package notarization and a change in builder configuration The macOS binaries for this release, and future 10.x releases, are now being compiled on macOS 10.15 (Catalina) with Xcode 11 to support package notarization, a requirement for installing .pkg files on macOS 10.15 and later. Previous builds of Node.js 10.x were compiled on macOS 10.7 (Lion). As binaries are still being compiled to support a minimum of macOS 10.7 (Lion) we do not anticipate this having a negative impact on Node.js 10.x users with older versions of macOS. Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - build: macOS package notarization (Rod Vagg) [#31459](#31459) - deps: - update npm to 6.14.3 (Myles Borins) [#32368](#32368) - upgrade openssl sources to 1.1.1e (Hassaan Pasha) [#32328](#32328) - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - define release 6 [#32058](#32058) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) - url: handle quasi-WHATWG URLs in urlToOptions() (cjihrig) [#26226](#26226) PR-URL: #31984

macOS package notarization and a change in builder configuration The macOS binaries for this release, and future 10.x releases, are now being compiled on macOS 10.15 (Catalina) with Xcode 11 to support package notarization, a requirement for installing .pkg files on macOS 10.15 and later. Previous builds of Node.js 10.x were compiled on macOS 10.10 (Yosemite) with a minimum deployment target of macOS 10.7 (Lion). As binaries are still being compiled to support a minimum of macOS 10.7 (Lion) we do not anticipate this having a negative impact on Node.js 10.x users with older versions of macOS. Notable changes: - buffer: add {read|write}Big\[U\]Int64{BE|LE} methods (garygsc) [#19691](#19691) - build: macOS package notarization (Rod Vagg) [#31459](#31459) - deps: - update npm to 6.14.3 (Myles Borins) [#32368](#32368) - upgrade openssl sources to 1.1.1e (Hassaan Pasha) [#32328](#32328) - upgrade to libuv 1.34.2 (cjihrig) [#31477](#31477) - n-api: - add napi\_get\_all\_property\_names (himself65) [#30006](#30006) - add APIs for per-instance state management (Gabriel Schulhof) [#28682](#28682) - define release 6 [#32058](#32058) - turn NAPI\_CALL\_INTO\_MODULE into a function (Anna Henningsen) [#26128](#26128) - tls: - expose keylog event on TLSSocket (Alba Mendez) [#27654](#27654) - support TLS min/max protocol defaults in CLI (Sam Roberts) [#27946](#27946) - url: handle quasi-WHATWG URLs in urlToOptions() (cjihrig) [#26226](#26226) PR-URL: #31984

richardlau reviewed May 29, 2019
View reviewed changes

Comment threaddoc/api/cli.md Outdated

mscdex added tls Issues and PRs related to the tls subsystem. v10.x labels May 29, 2019

addaleax changed the title ~~tls: support TLS min/max protocol defaults in CLI~~[v10.x] tls: support TLS min/max protocol defaults in CLIMay 29, 2019

addaleax approved these changes May 29, 2019
View reviewed changes

bnoordhuis approved these changes Jun 1, 2019
View reviewed changes

Comment threaddoc/api/cli.md Outdated

sam-github force-pushed the tls-min-max-cli-v10.x branch from 5fb1f1a to b329d2aCompare June 4, 2019 19:00

This comment has been minimized.
Sign in to view

sam-github force-pushed the tls-min-max-cli-v10.x branch 3 times, most recently from a5884ed to 436b0ddCompare June 5, 2019 16:56

BethGriggs approved these changes Jun 6, 2019
View reviewed changes

This comment has been minimized.
Sign in to view

sam-github force-pushed the tls-min-max-cli-v10.x branch from 436b0dd to f269280Compare June 7, 2019 17:33

codebytere approved these changes Jun 7, 2019
View reviewed changes

BethGriggs added the semver-minor PRs that contain new features and should be released in the next minor version. label Jun 28, 2019

sam-github mentioned this pull request Jul 23, 2019
tls.DEFAULT_MIN_VERSION according to docs is v11 feature, but its present in v10.16.0 and is incorrect #28758
Closed

This comment has been minimized.
Sign in to view

sam-github force-pushed the tls-min-max-cli-v10.x branch from 5854611 to d18c1e3Compare September 4, 2019 15:44

This comment has been minimized.
Sign in to view

BethGriggs closed this Feb 25, 2020

sam-github deleted the tls-min-max-cli-v10.x branch February 25, 2020 00:40

BethGriggs removed the lts-watch-v10.x label Feb 27, 2020

BethGriggs mentioned this pull request Mar 12, 2020
v10.20.0 proposal #31984
Merged

BethGriggs mentioned this pull request Feb 17, 2022
Expose a way to specify TLS version by node command line #27666
Closed

Uh oh!

Uh oh!

Conversation

sam-github commented May 29, 2019

Checklist

Uh oh!

sam-github commented May 29, 2019

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

nodejs-github-bot commented Jun 7, 2019

Uh oh!

BethGriggs commented Jun 7, 2019

Uh oh!

sam-github commented Jun 7, 2019• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sam-github commented Jun 7, 2019

Uh oh!

richardlau commented Jun 7, 2019

Uh oh!

nodejs-github-bot commented Jun 8, 2019

Uh oh!

nodejs-github-bot commented Jun 10, 2019

Uh oh!

sam-github commented Jun 10, 2019

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

BethGriggs commented Feb 24, 2020• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

nodejs-github-bot commented Feb 24, 2020

Uh oh!

BethGriggs commented Feb 24, 2020

Uh oh!

nodejs-github-bot commented Feb 24, 2020• edited by BethGriggs Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BethGriggs commented Feb 25, 2020

Uh oh!

sam-github commented Feb 25, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

sam-github commented Jun 7, 2019•
edited
Loading

BethGriggs commented Feb 24, 2020•
edited
Loading

nodejs-github-bot commented Feb 24, 2020•
edited by BethGriggs
Loading