tls: add option to override signature algorithms #29598

OYTIS · 2019-09-18T14:54:55Z

Passes the list down to SSL_CTX_set1_sigalgs_list.

My use case for this is using crypto hardware that has limited support for different algorithms (e.g. no RSA-PSS or no MD hashes) through an OpenSSL engine (enabled in another PR).

Can have other applications like hardening the server by disallowing short hashes, or disabling RSA-PKCS1 even when connecting via tls v1.2.

addaleax

Looks good code-wise, /cc @nodejs/crypto

doc/api/tls.md

sam-github

Thanks, this has been requested a couple times.

doc/api/tls.md

lib/_tls_common.js

doc/api/tls.md

lib/_tls_wrap.js

src/node_crypto.cc

test/parallel/test-tls-set-sigalgs.js

nodejs-github-bot · 2019-09-18T15:15:10Z

CI: https://ci.nodejs.org/job/node-test-pull-request/25549/

OYTIS · 2019-09-18T16:26:25Z

Also, on freebsd:

17:33:56 not ok 2319 parallel/test-worker-message-port-message-before-close
17:33:56   ---
17:33:56   duration_ms: 120.81
17:33:56   severity: fail
17:33:56   exitcode: -15
17:33:56   stack: |-
17:33:56     timeout
17:33:56   ...

Probably is not related to this PR (don't have a FreeBSD environment to tell for sure unfortunately).

bnoordhuis

The PR itself LGTM but I think it would be good to also have an API to query the signature algorithms.

src/node_crypto.cc

test/parallel/test-tls-set-sigalgs.js

sam-github · 2019-09-19T18:45:12Z

node.js is indeed inconsistently sloppy with its treatment of falsy values, and the code here is internally consistent, but the sloppiness has caused problems in various APIs (26af728), and is slowly getting better (04633ee), but better type-checking can be semver-major, so I'd prefer we not introduce new code that allows 0 and false to be accepted (and silently ignored) by an argument with a documented type of STRING.

OYTIS · 2019-09-19T20:53:39Z

@bnoordhuis Thank you, I missed that function, added a better test.

Other fixes coming soon.

OYTIS · 2019-09-20T09:50:51Z

OK, I believe everything is fixed now. Arrays of sigalgs are still not supported though, I understand it was optional (and should better go together with the respective fix for ciphers). CI failure seems unrelated.

sam-github

A couple nits, but looks pretty good, almost ready to land.

doc/api/tls.md

lib/_tls_common.js

lib/_tls_wrap.js

src/node_crypto.cc

nodejs-github-bot · 2019-09-20T16:43:02Z

CI: https://ci.nodejs.org/job/node-test-pull-request/25604/

sam-github · 2019-09-20T16:44:19Z

The travis failure looks completely unrelated, I kicked of a full CI.

@nodejs/streams , FYI:

=== release test-stream-writable-write-writev-finish ===
272Path: parallel/test-stream-writable-write-writev-finish
273--- stderr ---
274assert.js:129
275  throw err;
276  ^
277
278AssertionError [ERR_ASSERTION]: function should not have been called at /home/travis/build/nodejs/node/test/parallel/test-stream-writable-write-writev-finish.js:18
279    at Writable.mustNotCall (/home/travis/build/nodejs/node/test/common/index.js:429:12)
280    at Writable.emit (events.js:209:13)
281    at prefinish (_stream_writable.js:645:14)
282    at finishMaybe (_stream_writable.js:653:5)
283    at endWritable (_stream_writable.js:673:3)
284    at Writable.end (_stream_writable.js:596:5)
285    at Object.<anonymous> (/home/travis/build/nodejs/node/test/parallel/test-stream-writable-write-writev-finish.js:23:12)
286    at Module._compile (internal/modules/cjs/loader.js:943:30)
287    at Object.Module._extensions..js (internal/modules/cjs/loader.js:960:10)
288    at Module.load (internal/modules/cjs/loader.js:796:32) {
289  generatedMessage: false,
290  code: 'ERR_ASSERTION',
291  actual: undefined,
292  expected: undefined,
293  operator: 'fail'
294}
295Command: out/Release/node /home/travis/build/nodejs/node/test/parallel/test-stream-writable-write-writev-finish.js

src/node_crypto.cc

doc/api/tls.md

OYTIS · 2019-09-23T11:43:47Z

@addaleax Thank you for the review, all should be fixed now.

addaleax · 2019-09-23T11:45:50Z

and please also add an entry to the top of the changes section for tls.createSecureContext() below.

I think this is still missing :) We generally document when a new option has been added, so that people can figure out what versions provide a certain functionality.

OYTIS · 2019-09-23T12:11:16Z

Done, thank you.

addaleax

@sam-github Can you take another look? This seems ready to me.

doc/api/tls.md

nodejs-github-bot · 2019-09-23T12:23:15Z

CI: https://ci.nodejs.org/job/node-test-pull-request/25644/

Passes the list down to SSL_CTX_set1_sigalgs_list. Option to get the list of shared signature algorithms from a TLS socket added as well for testing. Signed-off-by: Anton Gerasimov <agerasimov@twilio.com>

OYTIS · 2019-09-23T12:37:34Z

The Jenkins failure is because of the error @addaleax pointed me to, needs restarting.

nodejs-github-bot · 2019-09-23T13:30:10Z

CI: https://ci.nodejs.org/job/node-test-pull-request/25646/

OYTIS · 2019-09-23T14:44:47Z

Not sure what these *linked* tests are, but it seems these results are also old.

Trott · 2019-09-24T06:34:13Z

Landed in 0c32ca9

Passes the list down to SSL_CTX_set1_sigalgs_list. Option to get the list of shared signature algorithms from a TLS socket added as well for testing. Signed-off-by: Anton Gerasimov <agerasimov@twilio.com> PR-URL: #29598 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Anna Henningsen <anna@addaleax.net>

Trott · 2019-09-24T06:34:52Z

Thanks for the contribution! 🎉

Passes the list down to SSL_CTX_set1_sigalgs_list. Option to get the list of shared signature algorithms from a TLS socket added as well for testing. Signed-off-by: Anton Gerasimov <agerasimov@twilio.com> PR-URL: #29598 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Anna Henningsen <anna@addaleax.net>

Notable changes: * crypto: * Add `oaepLabel` option #29489 * deps: * Update V8 to 7.7.299.11 #28918 * More efficient memory handling * Stack trace serialization got faster * The `Intl.NumberFormat` API gained new functionality * For more information: https://v8.dev/blog/v8-release-77 * events: * Add support for `EventTarget` in `once` #29498 * fs: * Expose memory file mapping flag `UV_FS_O_FILEMAP` #29260 * inspector: * New API - `Session.connectToMainThread` #28870 * process: * Initial SourceMap support via `env.NODE_V8_COVERAGE` #28960 * stream: * Make `_write()` optional when `_writev()` is implemented #29639 * tls: * Add option to override signature algorithms #29598 * util: * Add `encodeInto` to `TextEncoder` #29524 * worker: * The `worker_thread` module is now stable #29512

Passes the list down to SSL_CTX_set1_sigalgs_list. Option to get the list of shared signature algorithms from a TLS socket added as well for testing. Signed-off-by: Anton Gerasimov <agerasimov@twilio.com> PR-URL: #29598 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Anna Henningsen <anna@addaleax.net>

Notable changes: * crypto: * Add `oaepLabel` option #29489 * deps: * Update V8 to 7.7.299.11 #28918 * More efficient memory handling * Stack trace serialization got faster * The `Intl.NumberFormat` API gained new functionality * For more information: https://v8.dev/blog/v8-release-77 * events: * Add support for `EventTarget` in `once` #29498 * fs: * Expose memory file mapping flag `UV_FS_O_FILEMAP` #29260 * inspector: * New API - `Session.connectToMainThread` #28870 * process: * Initial SourceMap support via `env.NODE_V8_COVERAGE` #28960 * stream: * Make `_write()` optional when `_writev()` is implemented #29639 * tls: * Add option to override signature algorithms #29598 * util: * Add `encodeInto` to `TextEncoder` #29524 * worker: * The `worker_thread` module is now stable #29512 PR-URL: #29695

Node.js recently added an option to override signature algorithms in nodejs/node#29598 which make use of several NIDs and SSL_get_shared_sigalgs. This CL adds NIDs for Ed448 (but does not implement it) and a shim function for SSL_get_shared_sigalgs that simply returns 0. This enables Electron to reduce its patch surface. Change-Id: I833d30b0248ca68ebce4767dd58d5f087fd1e18e Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/38404 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. labels Sep 18, 2019

addaleax reviewed Sep 18, 2019

View reviewed changes

doc/api/tls.md Show resolved Hide resolved

sam-github added the semver-minor PRs that contain new features and should be released in the next minor version. label Sep 18, 2019

sam-github suggested changes Sep 18, 2019

View reviewed changes

bnoordhuis approved these changes Sep 18, 2019

View reviewed changes

src/node_crypto.cc Outdated Show resolved Hide resolved

test/parallel/test-tls-set-sigalgs.js Outdated Show resolved Hide resolved

OYTIS force-pushed the sigalgs branch from ba21877 to fce68a2 Compare September 19, 2019 20:51

OYTIS force-pushed the sigalgs branch from fce68a2 to 598c2a0 Compare September 20, 2019 08:49

sam-github reviewed Sep 20, 2019

View reviewed changes

OYTIS force-pushed the sigalgs branch from 598c2a0 to 0367cd5 Compare September 20, 2019 16:56

addaleax approved these changes Sep 20, 2019

View reviewed changes

src/node_crypto.cc Outdated Show resolved Hide resolved

src/node_crypto.cc Outdated Show resolved Hide resolved

doc/api/tls.md Show resolved Hide resolved

OYTIS force-pushed the sigalgs branch from 0367cd5 to 546e1e0 Compare September 23, 2019 11:43

OYTIS force-pushed the sigalgs branch from 546e1e0 to 3d18720 Compare September 23, 2019 12:11

addaleax reviewed Sep 23, 2019

View reviewed changes

doc/api/tls.md Outdated Show resolved Hide resolved

tls: add option to override signature algorithms

2b976ab

Passes the list down to SSL_CTX_set1_sigalgs_list. Option to get the list of shared signature algorithms from a TLS socket added as well for testing. Signed-off-by: Anton Gerasimov <agerasimov@twilio.com>

OYTIS force-pushed the sigalgs branch from 3d18720 to 2b976ab Compare September 23, 2019 12:25

sam-github approved these changes Sep 23, 2019

View reviewed changes

Trott closed this Sep 24, 2019

BridgeAR mentioned this pull request Sep 24, 2019

v12.11.0 proposal #29695

Merged

ghost mentioned this pull request Sep 26, 2019

Unhandled rejection CloudflareError: 1020 codemanki/cloudscraper#268

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tls: add option to override signature algorithms #29598

tls: add option to override signature algorithms #29598

OYTIS commented Sep 18, 2019 •

edited

Loading

addaleax left a comment

sam-github left a comment

nodejs-github-bot commented Sep 18, 2019

OYTIS commented Sep 18, 2019

bnoordhuis left a comment

sam-github commented Sep 19, 2019

OYTIS commented Sep 19, 2019

OYTIS commented Sep 20, 2019

sam-github left a comment

nodejs-github-bot commented Sep 20, 2019

sam-github commented Sep 20, 2019

OYTIS commented Sep 23, 2019

addaleax commented Sep 23, 2019

OYTIS commented Sep 23, 2019

addaleax left a comment

nodejs-github-bot commented Sep 23, 2019

OYTIS commented Sep 23, 2019

nodejs-github-bot commented Sep 23, 2019

OYTIS commented Sep 23, 2019

Trott commented Sep 24, 2019

Trott commented Sep 24, 2019

tls: add option to override signature algorithms #29598

tls: add option to override signature algorithms #29598

Conversation

OYTIS commented Sep 18, 2019 • edited Loading

addaleax left a comment

Choose a reason for hiding this comment

sam-github left a comment

Choose a reason for hiding this comment

nodejs-github-bot commented Sep 18, 2019

OYTIS commented Sep 18, 2019

bnoordhuis left a comment

Choose a reason for hiding this comment

sam-github commented Sep 19, 2019

OYTIS commented Sep 19, 2019

OYTIS commented Sep 20, 2019

sam-github left a comment

Choose a reason for hiding this comment

nodejs-github-bot commented Sep 20, 2019

sam-github commented Sep 20, 2019

OYTIS commented Sep 23, 2019

addaleax commented Sep 23, 2019

OYTIS commented Sep 23, 2019

addaleax left a comment

Choose a reason for hiding this comment

nodejs-github-bot commented Sep 23, 2019

OYTIS commented Sep 23, 2019

nodejs-github-bot commented Sep 23, 2019

OYTIS commented Sep 23, 2019

Trott commented Sep 24, 2019

Trott commented Sep 24, 2019

OYTIS commented Sep 18, 2019 •

edited

Loading