FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

tls: add unsupported renegotiation error · nodejs/node@94e5f63 · GitHub

/ node Public

Commit 94e5f63

Browse files
panva
authored and
aduh95
committed
tls: add unsupported renegotiation error
Map BoringSSL's native renegotiation failure to ERR_TLS_RENEGOTIATION_UNSUPPORTED when TLSSocket#renegotiate() is called. This avoids exposing an implementation-specific OpenSSL error when the TLS backend does not support caller-initiated renegotiation. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63161 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
1 parent aaef29e commit 94e5f63

4 files changed

Lines changed: 32 additions & 9 deletions

File tree

‎doc/api/errors.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3084,6 +3084,13 @@ Failed to set PSK identity hint. Hint may be too long.
30843084
An attempt was made to renegotiate TLS on a socket instance with renegotiation
30853085
disabled.
30863086

3087+
<a id="ERR_TLS_RENEGOTIATION_UNSUPPORTED"></a>
3088+
3089+
### `ERR_TLS_RENEGOTIATION_UNSUPPORTED`
3090+
3091+
An attempt was made to renegotiate TLS, but the TLS implementation does not
3092+
support caller-initiated renegotiation.
3093+
30873094
<a id="ERR_TLS_REQUIRED_SERVER_NAME"></a>
30883095

30893096
### `ERR_TLS_REQUIRED_SERVER_NAME`

‎lib/internal/errors.js‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1827,6 +1827,8 @@ E('ERR_TLS_PROTOCOL_VERSION_CONFLICT',
18271827
'TLS protocol version %j conflicts with secureProtocol %j', TypeError);
18281828
E('ERR_TLS_RENEGOTIATION_DISABLED',
18291829
'TLS session renegotiation disabled for this socket', Error);
1830+
E('ERR_TLS_RENEGOTIATION_UNSUPPORTED',
1831+
'TLS session renegotiation is unsupported by this TLS implementation', Error);
18301832

18311833
// This should probably be a `TypeError`.
18321834
E('ERR_TLS_REQUIRED_SERVER_NAME',

‎lib/internal/tls/wrap.js‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ const {
7272
ERR_TLS_INVALID_CONTEXT,
7373
ERR_TLS_INVALID_STATE,
7474
ERR_TLS_RENEGOTIATION_DISABLED,
75+
ERR_TLS_RENEGOTIATION_UNSUPPORTED,
7576
ERR_TLS_REQUIRED_SERVER_NAME,
7677
ERR_TLS_SESSION_ATTACK,
7778
ERR_TLS_SNI_FROM_SERVER,
@@ -1092,8 +1093,13 @@ TLSSocket.prototype.renegotiate = function(options, callback) {
10921093
try {
10931094
this._handle.renegotiate();
10941095
} catch (err) {
1096+
const isBoringSSLRenegotiationUnsupported =
1097+
process.features.openssl_is_boringssl &&
1098+
err?.code === 'ERR_SSL_FUNCTION_SHOULD_NOT_HAVE_BEEN_CALLED';
1099+
const error = isBoringSSLRenegotiationUnsupported ?
1100+
new ERR_TLS_RENEGOTIATION_UNSUPPORTED() : err;
10951101
if (callback) {
1096-
process.nextTick(callback, err);
1102+
process.nextTick(callback, error);
10971103
}
10981104
return false;
10991105
}

‎test/parallel/test-tls-client-renegotiation-13.js‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,22 @@ connect({
3232
assert.strictEqual(client.getProtocol(), 'TLSv1.3');
3333

3434
const ok = client.renegotiate({}, common.mustCall((err) => {
35-
assert.throws(() => { throw err; }, {
36-
message: hasOpenSSL3 ?
37-
'error:0A00010A:SSL routines::wrong ssl version' :
38-
'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
39-
code: 'ERR_SSL_WRONG_SSL_VERSION',
40-
library: 'SSL routines',
41-
reason: 'wrong ssl version',
42-
});
35+
if (process.features.openssl_is_boringssl) {
36+
assert.throws(() => { throw err; }, {
37+
message: 'TLS session renegotiation is unsupported by this TLS ' +
38+
'implementation',
39+
code: 'ERR_TLS_RENEGOTIATION_UNSUPPORTED',
40+
});
41+
} else {
42+
assert.throws(() => { throw err; }, {
43+
message: hasOpenSSL3 ?
44+
'error:0A00010A:SSL routines::wrong ssl version' :
45+
'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
46+
code: 'ERR_SSL_WRONG_SSL_VERSION',
47+
library: 'SSL routines',
48+
reason: 'wrong ssl version',
49+
});
50+
}
4351
cleanup();
4452
}));
4553

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL