-
Notifications
You must be signed in to change notification settings - Fork 29.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[v11.x backport] TLS1.3 #26951
[v11.x backport] TLS1.3 #26951
Commits on Apr 11, 2019
-
tls: add code for ERR_TLS_INVALID_PROTOCOL_METHOD
Add an error code property to invalid `secureProtocol` method exceptions. PR-URL: nodejs#24729 Reviewed-By: Joyee Cheung <[email protected]> Reviewed-By: James M Snell <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 742c920 - Browse repository at this point
Copy the full SHA 742c920View commit details -
tls: revert change to invalid protocol error type
In nodejs#24729, the error was changed to be a TypeError, which is the standard type for this kind of error. However, it was Error in 11.x and earlier, so revert that single aspect, so the backport can be semver-minor.
Configuration menu - View commit details
-
Copy full SHA for dc1c40b - Browse repository at this point
Copy the full SHA dc1c40bView commit details -
src: add .code and SSL specific error properties
SSL errors have a long structured message, but lacked the standard .code property which can be used for stable comparisons. Add a `code` property, as well as the 3 string components of an SSL error: `reason`, `library`, and `function`. PR-URL: nodejs#25093 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Daniel Bevenius <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 69d53f6 - Browse repository at this point
Copy the full SHA 69d53f6View commit details -
deps: upgrade openssl sources to 1.1.1b
This updates all sources in deps/openssl/openssl with openssl-1.1.1b. PR-URL: nodejs#26327 Reviewed-By: Gireesh Punathil <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 5f12a8a - Browse repository at this point
Copy the full SHA 5f12a8aView commit details -
deps: add s390 asm rules for OpenSSL-1.1.1
This is a floating patch against OpenSSL-1.1.1 to generate asm files with Makefile rules. PR-URL: nodejs#26327 Reviewed-By: Gireesh Punathil <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> Original: Fixes: nodejs#4270 PR-URL: nodejs#19794 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rod Vagg <[email protected]> Reviewed-By: Michael Dawson <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 7b132ba - Browse repository at this point
Copy the full SHA 7b132baView commit details -
deps: update archs files for OpenSSL-1.1.1b
`cd deps/openssl/config; make` updates all archs dependant files. PR-URL: nodejs#26327 Reviewed-By: Gireesh Punathil <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 9ac83c7 - Browse repository at this point
Copy the full SHA 9ac83c7View commit details -
This introduces TLS1.3 support and makes it the default max protocol, but also supports CLI/NODE_OPTIONS switches to disable it if necessary. TLS1.3 is a major update to the TLS protocol, with many security enhancements. It should be preferred over TLS1.2 whenever possible. TLS1.3 is different enough that even though the OpenSSL APIs are technically API/ABI compatible, that when TLS1.3 is negotiated, the timing of protocol records and of callbacks broke assumptions hard-coded into the 'tls' module. This change introduces no API incompatibilities when TLS1.2 is negotiated. It is the intention that it be backported to current and LTS release lines with the default maximum TLS protocol reset to 'TLSv1.2'. This will allow users of those lines to explicitly enable TLS1.3 if they want. API incompatibilities between TLS1.2 and TLS1.3 are: - Renegotiation is not supported by TLS1.3 protocol, attempts to call `.renegotiate()` will always fail. - Compiling against a system OpenSSL lower than 1.1.1 is no longer supported (OpenSSL-1.1.0 used to be supported with configure flags). - Variations of `conn.write('data'); conn.destroy()` have undefined behaviour according to the streams API. They may or may not send the 'data', and may or may not cause a ERR_STREAM_DESTROYED error to be emitted. This has always been true, but conditions under which the write suceeds is slightly but observably different when TLS1.3 is negotiated vs when TLS1.2 or below is negotiated. - If TLS1.3 is negotiated, and a server calls `conn.end()` in its 'secureConnection' listener without any data being written, the client will not receive session tickets (no 'session' events will be emitted, and `conn.getSession()` will never return a resumable session). - The return value of `conn.getSession()` API may not return a resumable session if called right after the handshake. The effect will be that clients using the legacy `getSession()` API will resume sessions if TLS1.2 is negotiated, but will do full handshakes if TLS1.3 is negotiated. See nodejs#25831 for more information. PR-URL: nodejs#26209 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rod Vagg <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 921a040 - Browse repository at this point
Copy the full SHA 921a040View commit details -
tls: revert default max to TLSv1.2
TLSv1.3 is still supported when explicitly configured, but it is not the default.
Configuration menu - View commit details
-
Copy full SHA for 06dd4b2 - Browse repository at this point
Copy the full SHA 06dd4b2View commit details -
tls: add CHECK for impossible condition
PR-URL: nodejs#26843 Reviewed-By: Sam Roberts <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Minwoo Jung <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for fc0fc8a - Browse repository at this point
Copy the full SHA fc0fc8aView commit details -
tls: add debugging to native TLS code
PR-URL: nodejs#26843 Reviewed-By: Sam Roberts <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Minwoo Jung <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 2aaffb6 - Browse repository at this point
Copy the full SHA 2aaffb6View commit details -
doc: describe tls.DEFAULT_MIN_VERSION/_MAX_VERSION
PR-URL: nodejs#26821 Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 6589fe1 - Browse repository at this point
Copy the full SHA 6589fe1View commit details -
Configuration menu - View commit details
-
Copy full SHA for 3462f8a - Browse repository at this point
Copy the full SHA 3462f8aView commit details -
tls: add --tls-min-v1.2 CLI switch
For 11.x, the default minimum is TLSv1, so it needs a CLI switch to change the default to the more secure minimum of TLSv1.2.
Configuration menu - View commit details
-
Copy full SHA for 011574f - Browse repository at this point
Copy the full SHA 011574fView commit details