FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

tls: revert default max to TLSv1.2 · nodejs/node@109c097 · GitHub

/ node Public

Commit 109c097

Browse files
sam-github
authored and
BethGriggs
committed
tls: revert default max to TLSv1.2
TLSv1.3 is still supported when explicitly configured, but it is not the default. PR-URL: #26951 Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
1 parent 7393e37 commit 109c097

9 files changed

Lines changed: 21 additions & 13 deletions

‎doc/api/tls.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1351,7 +1351,7 @@ changes:
13511351
* `maxVersion` {string} Optionally set the maximum TLS version to allow. One
13521352
of `TLSv1.3`, `TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. Cannot be specified
13531353
along with the `secureProtocol` option, use one or the other.
1354-
**Default:** `'TLSv1.3'`, unless changed using CLI options. Using
1354+
**Default:** `'TLSv1.2'`, unless changed using CLI options. Using
13551355
`--tls-max-v1.2` sets the default to `'TLSv1.2`'. Using `--tls-max-v1.3`
13561356
sets the default to `'TLSv1.3'`. If multiple of the options are provided,
13571357
the highest maximum is used.
@@ -1360,7 +1360,7 @@ changes:
13601360
along with the `secureProtocol` option, use one or the other. It is not
13611361
recommended to use less than TLSv1.2, but it may be required for
13621362
interoperability.
1363-
**Default:** `'TLSv1.2'`, unless changed using CLI options. Using
1363+
**Default:** `'TLSv1'`, unless changed using CLI options. Using
13641364
`--tls-min-v1.0` sets the default to `'TLSv1'`. Using `--tls-min-v1.1` sets
13651365
the default to `'TLSv1.1'`. Using `--tls-min-v1.3` sets the default to
13661366
`'TLSv1.3'`. If multiple of the options are provided, the lowest minimum is

‎lib/tls.js‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,6 @@ exports.DEFAULT_CIPHERS =
5454

5555
exports.DEFAULT_ECDH_CURVE = 'auto';
5656

57-
exports.DEFAULT_MAX_VERSION = 'TLSv1.3';
58-
5957
if (getOptionValue('--tls-min-v1.0'))
6058
exports.DEFAULT_MIN_VERSION = 'TLSv1';
6159
else if (getOptionValue('--tls-min-v1.1'))
@@ -70,7 +68,7 @@ if (getOptionValue('--tls-max-v1.3'))
7068
else if (getOptionValue('--tls-max-v1.2'))
7169
exports.DEFAULT_MAX_VERSION = 'TLSv1.2';
7270
else
73-
exports.DEFAULT_MAX_VERSION = 'TLSv1.3'; // Will depend on node version.
71+
exports.DEFAULT_MAX_VERSION = 'TLSv1.2'; // Will depend on node version.
7472

7573

7674
exports.getCiphers = internalUtil.cachedResult(

‎src/node_options.cc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -341,15 +341,15 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
341341
&EnvironmentOptions::tls_min_v1_3,
342342
kAllowedInEnvironment);
343343
AddOption("--tls-max-v1.2",
344-
"set default TLS maximum to TLSv1.2 (default: TLSv1.3)",
344+
"set default TLS maximum to TLSv1.2 (default: TLSv1.2)",
345345
&EnvironmentOptions::tls_max_v1_2,
346346
kAllowedInEnvironment);
347347
// Current plan is:
348348
// - 11.x and below: TLS1.3 is opt-in with --tls-max-v1.3
349349
// - 12.x: TLS1.3 is opt-out with --tls-max-v1.2
350350
// In either case, support both options they are uniformly available.
351351
AddOption("--tls-max-v1.3",
352-
"set default TLS maximum to TLSv1.3 (default: TLSv1.3)",
352+
"set default TLS maximum to TLSv1.3 (default: TLSv1.2)",
353353
&EnvironmentOptions::tls_max_v1_3,
354354
kAllowedInEnvironment);
355355
}

‎test/parallel/test-tls-cli-min-version-1.0.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ if (!common.hasCrypto) common.skip('missing crypto');
88
const assert = require('assert');
99
const tls = require('tls');
1010

11-
assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
11+
assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.2');
1212
assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1');
1313

1414
// Check the min-max version protocol versions against these CLI settings.

‎test/parallel/test-tls-cli-min-version-1.1.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ if (!common.hasCrypto) common.skip('missing crypto');
88
const assert = require('assert');
99
const tls = require('tls');
1010

11-
assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
11+
assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.2');
1212
assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.1');
1313

1414
// Check the min-max version protocol versions against these CLI settings.

‎test/parallel/test-tls-cli-min-version-1.3.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ if (!common.hasCrypto) common.skip('missing crypto');
88
const assert = require('assert');
99
const tls = require('tls');
1010

11-
assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
11+
assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.2');
1212
assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.3');
1313

1414
// Check the min-max version protocol versions against these CLI settings.

‎test/parallel/test-tls-client-renegotiation-13.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
// Flags: --tls-max-v1.3
12
'use strict';
23

34
const common = require('../common');

‎test/parallel/test-tls-min-max-version.js‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,13 @@ function test(cmin, cmax, cprot, smin, smax, sprot, proto, cerr, serr) {
6868

6969
const U = undefined;
7070

71-
// Default protocol is the max version.
72-
test(U, U, U, U, U, U, DEFAULT_MAX_VERSION);
71+
if (DEFAULT_MAX_VERSION === 'TLSv1.2' && DEFAULT_MIN_VERSION === 'TLSv1.3') {
72+
// No connections are possible by default.
73+
test(U, U, U, U, U, U, U, 'ERR_SSL_NO_PROTOCOLS_AVAILABLE', U);
74+
} else {
75+
// Default protocol is the max version.
76+
test(U, U, U, U, U, U, DEFAULT_MAX_VERSION);
77+
}
7378

7479
// Insecure or invalid protocols cannot be enabled.
7580
test(U, U, U, U, U, 'SSLv2_method',

‎test/parallel/test-tls-set-ciphers.js‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,13 @@ const fixtures = require('../common/fixtures');
66
// Test cipher: option for TLS.
77

88
const {
9-
assert, connect, keys
9+
assert, connect, keys, tls
1010
} = require(fixtures.path('tls-connect'));
1111

12+
const tls13 = !!require('constants').TLS1_3_VERSION;
13+
14+
if (tls13)
15+
tls.DEFAULT_MAX_VERSION = 'TLSv1.3';
1216

1317
function test(cciphers, sciphers, cipher, cerr, serr) {
1418
assert(cipher || cerr || serr, 'test missing any expectations');

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL