Commit 31dadd2
crypto: deprecate {ecdhCurve: false}
This doesn't work in OpenSSL 1.1.0. Per discussion on the PR, it is
preferable to just deprecate this setting. Deprecate it and skip the
test in OpenSSL 1.1.0.
PR-URL: #16130
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Rod Vagg <rod@vagg.org>1 parent 26e4c58 commit 31dadd2
3 files changed
Lines changed: 30 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -737,6 +737,16 @@ Type: Runtime | |||
| 737 | 737 | internal mechanics of the `REPLServer` itself, and is therefore not | |
| 738 | 738 | necessary in user space. | |
| 739 | 739 | ||
| 740 | + <a id="DEP0083"></a> | ||
| 741 | + ### DEP0083: Disabling ECDH by setting ecdhCurve to false | ||
| 742 | + | ||
| 743 | + Type: Runtime | ||
| 744 | + | ||
| 745 | + The `ecdhCurve` option to `tls.createSecureContext()` and `tls.TLSSocket` could | ||
| 746 | + be set to `false` to disable ECDH entirely on the server only. This mode is | ||
| 747 | + deprecated in preparation for migrating to OpenSSL 1.1.0 and consistency with | ||
| 748 | + the client. Use the `ciphers` parameter instead. | ||
| 749 | + | ||
| 740 | 750 | ||
| 741 | 751 | [`Buffer.allocUnsafeSlow(size)`]: buffer.html#buffer_class_method_buffer_allocunsafeslow_size | |
| 742 | 752 | [`Buffer.from(array)`]: buffer.html#buffer_class_method_buffer_from_array | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -65,6 +65,16 @@ function validateKeyCert(value, type) { | |||
| 65 | 65 | exports.SecureContext = SecureContext; | |
| 66 | 66 | ||
| 67 | 67 | ||
| 68 | + function ecdhCurveWarning() { | ||
| 69 | + if (ecdhCurveWarning.emitted) return; | ||
| 70 | + process.emitWarning('{ ecdhCurve: false } is deprecated.', | ||
| 71 | + 'DeprecationWarning', | ||
| 72 | + 'DEP0083'); | ||
| 73 | + ecdhCurveWarning.emitted = true; | ||
| 74 | + } | ||
| 75 | + ecdhCurveWarning.emitted = false; | ||
| 76 | + | ||
| 77 | + | ||
| 68 | 78 | exports.createSecureContext = function createSecureContext(options, context) { | |
| 69 | 79 | if (!options) options = {}; | |
| 70 | 80 | ||
@@ -140,6 +150,8 @@ exports.createSecureContext = function createSecureContext(options, context) { | |||
| 140 | 150 | c.context.setECDHCurve(tls.DEFAULT_ECDH_CURVE); | |
| 141 | 151 | else if (options.ecdhCurve) | |
| 142 | 152 | c.context.setECDHCurve(options.ecdhCurve); | |
| 153 | + else | ||
| 154 | + ecdhCurveWarning(); | ||
| 143 | 155 | ||
| 144 | 156 | if (options.dhparam) { | |
| 145 | 157 | const warning = c.context.setDHParam(options.dhparam); | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -31,6 +31,11 @@ if (!common.hasCrypto) | |||
| 31 | 31 | if (!common.opensslCli) | |
| 32 | 32 | common.skip('missing openssl-cli'); | |
| 33 | 33 | ||
| 34 | + const OPENSSL_VERSION_NUMBER = | ||
| 35 | + require('crypto').constants.OPENSSL_VERSION_NUMBER; | ||
| 36 | + if (OPENSSL_VERSION_NUMBER >= 0x10100000) | ||
| 37 | + common.skip('false ecdhCurve not supported in OpenSSL 1.1.0'); | ||
| 38 | + | ||
| 34 | 39 | const assert = require('assert'); | |
| 35 | 40 | const tls = require('tls'); | |
| 36 | 41 | const exec = require('child_process').exec; | |
@@ -42,6 +47,9 @@ const options = { | |||
| 42 | 47 | ecdhCurve: false | |
| 43 | 48 | }; | |
| 44 | 49 | ||
| 50 | + common.expectWarning('DeprecationWarning', | ||
| 51 | + '{ ecdhCurve: false } is deprecated.'); | ||
| 52 | + | ||
| 45 | 53 | const server = tls.createServer(options, common.mustNotCall()); | |
| 46 | 54 | ||
| 47 | 55 | server.listen(0, '127.0.0.1', common.mustCall(function() { | |
0 commit comments