Commit cfb2f34
tls: cleanup onhandshakestart callback
Re-arrange and cleanup the flow of the onhandshakestart to be
more clear and less repetitive. Exit early in the case of a
first ever handshake for a given connection.
PR-URL: #20466
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>1 parent d0cbb4c commit cfb2f34
1 file changed
Lines changed: 15 additions & 19 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -62,32 +62,28 @@ const noop = () => {}; | |||
| 62 | 62 | function onhandshakestart(now) { | |
| 63 | 63 | debug('onhandshakestart'); | |
| 64 | 64 | ||
| 65 | - assert(now >= this.lastHandshakeTime); | ||
| 65 | + const { lastHandshakeTime } = this; | ||
| 66 | + assert(now >= lastHandshakeTime); | ||
| 66 | 67 | ||
| 67 | - const owner = this.owner; | ||
| 68 | + this.lastHandshakeTime = now; | ||
| 68 | 69 | ||
| 69 | - if ((now - this.lastHandshakeTime) >= tls.CLIENT_RENEG_WINDOW * 1000) { | ||
| 70 | - this.handshakes = 0; | ||
| 71 | - } | ||
| 70 | + // If this is the first handshake we can skip the rest of the checks. | ||
| 71 | + if (lastHandshakeTime === 0) | ||
| 72 | + return; | ||
| 72 | 73 | ||
| 73 | - const first = (this.lastHandshakeTime === 0); | ||
| 74 | - this.lastHandshakeTime = now; | ||
| 75 | - if (first) return; | ||
| 74 | + if ((now - lastHandshakeTime) >= tls.CLIENT_RENEG_WINDOW * 1000) | ||
| 75 | + this.handshakes = 1; | ||
| 76 | + else | ||
| 77 | + this.handshakes++; | ||
| 76 | 78 | ||
| 77 | - if (++this.handshakes > tls.CLIENT_RENEG_LIMIT) { | ||
| 78 | - // Defer the error event to the next tick. We're being called from OpenSSL's | ||
| 79 | - // state machine and OpenSSL is not re-entrant. We cannot allow the user's | ||
| 80 | - // callback to destroy the connection right now, it would crash and burn. | ||
| 81 | - setImmediate(emitSessionAttackError, owner); | ||
| 79 | + const { owner } = this; | ||
| 80 | + if (this.handshakes > tls.CLIENT_RENEG_LIMIT) { | ||
| 81 | + owner._emitTLSError(new ERR_TLS_SESSION_ATTACK()); | ||
| 82 | + return; | ||
| 82 | 83 | } | |
| 83 | 84 | ||
| 84 | - if (owner[kDisableRenegotiation] && this.handshakes > 0) { | ||
| 85 | + if (owner[kDisableRenegotiation]) | ||
| 85 | 86 | owner._emitTLSError(new ERR_TLS_RENEGOTIATION_DISABLED()); | |
| 86 | - } | ||
| 87 | - } | ||
| 88 | - | ||
| 89 | - function emitSessionAttackError(socket) { | ||
| 90 | - socket._emitTLSError(new ERR_TLS_SESSION_ATTACK()); | ||
| 91 | 87 | } | |
| 92 | 88 | ||
| 93 | 89 | function onhandshakedone() { | |
0 commit comments