FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

tls: add unsupported renegotiation error · nodejs/node@2ba124f · GitHub

/ node Public

Commit 2ba124f

Browse files
panva
authored and
aduh95
committed
tls: add unsupported renegotiation error
Map BoringSSL's native renegotiation failure to ERR_TLS_RENEGOTIATION_UNSUPPORTED when TLSSocket#renegotiate() is called. This avoids exposing an implementation-specific OpenSSL error when the TLS backend does not support caller-initiated renegotiation. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63161 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
1 parent c1f6ba2 commit 2ba124f

4 files changed

Lines changed: 32 additions & 9 deletions

File tree

‎doc/api/errors.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3132,6 +3132,13 @@ Failed to set PSK identity hint. Hint may be too long.
31323132
An attempt was made to renegotiate TLS on a socket instance with renegotiation
31333133
disabled.
31343134

3135+
<a id="ERR_TLS_RENEGOTIATION_UNSUPPORTED"></a>
3136+
3137+
### `ERR_TLS_RENEGOTIATION_UNSUPPORTED`
3138+
3139+
An attempt was made to renegotiate TLS, but the TLS implementation does not
3140+
support caller-initiated renegotiation.
3141+
31353142
<a id="ERR_TLS_REQUIRED_SERVER_NAME"></a>
31363143

31373144
### `ERR_TLS_REQUIRED_SERVER_NAME`

‎lib/internal/errors.js‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1843,6 +1843,8 @@ E('ERR_TLS_PROTOCOL_VERSION_CONFLICT',
18431843
'TLS protocol version %j conflicts with secureProtocol %j', TypeError);
18441844
E('ERR_TLS_RENEGOTIATION_DISABLED',
18451845
'TLS session renegotiation disabled for this socket', Error);
1846+
E('ERR_TLS_RENEGOTIATION_UNSUPPORTED',
1847+
'TLS session renegotiation is unsupported by this TLS implementation', Error);
18461848

18471849
// This should probably be a `TypeError`.
18481850
E('ERR_TLS_REQUIRED_SERVER_NAME',

‎lib/internal/tls/wrap.js‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ const {
7272
ERR_TLS_INVALID_CONTEXT,
7373
ERR_TLS_INVALID_STATE,
7474
ERR_TLS_RENEGOTIATION_DISABLED,
75+
ERR_TLS_RENEGOTIATION_UNSUPPORTED,
7576
ERR_TLS_REQUIRED_SERVER_NAME,
7677
ERR_TLS_SESSION_ATTACK,
7778
ERR_TLS_SNI_FROM_SERVER,
@@ -1014,8 +1015,13 @@ TLSSocket.prototype.renegotiate = function(options, callback) {
10141015
try {
10151016
this._handle.renegotiate();
10161017
} catch (err) {
1018+
const isBoringSSLRenegotiationUnsupported =
1019+
process.features.openssl_is_boringssl &&
1020+
err?.code === 'ERR_SSL_FUNCTION_SHOULD_NOT_HAVE_BEEN_CALLED';
1021+
const error = isBoringSSLRenegotiationUnsupported ?
1022+
new ERR_TLS_RENEGOTIATION_UNSUPPORTED() : err;
10171023
if (callback) {
1018-
process.nextTick(callback, err);
1024+
process.nextTick(callback, error);
10191025
}
10201026
return false;
10211027
}

‎test/parallel/test-tls-client-renegotiation-13.js‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,22 @@ connect({
3232
assert.strictEqual(client.getProtocol(), 'TLSv1.3');
3333

3434
const ok = client.renegotiate({}, common.mustCall((err) => {
35-
assert.throws(() => { throw err; }, {
36-
message: hasOpenSSL3 ?
37-
'error:0A00010A:SSL routines::wrong ssl version' :
38-
'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
39-
code: 'ERR_SSL_WRONG_SSL_VERSION',
40-
library: 'SSL routines',
41-
reason: 'wrong ssl version',
42-
});
35+
if (process.features.openssl_is_boringssl) {
36+
assert.throws(() => { throw err; }, {
37+
message: 'TLS session renegotiation is unsupported by this TLS ' +
38+
'implementation',
39+
code: 'ERR_TLS_RENEGOTIATION_UNSUPPORTED',
40+
});
41+
} else {
42+
assert.throws(() => { throw err; }, {
43+
message: hasOpenSSL3 ?
44+
'error:0A00010A:SSL routines::wrong ssl version' :
45+
'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
46+
code: 'ERR_SSL_WRONG_SSL_VERSION',
47+
library: 'SSL routines',
48+
reason: 'wrong ssl version',
49+
});
50+
}
4351
cleanup();
4452
}));
4553

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL