crypto: support multiple ECDH curves and auto

Using SSL_CTX_set1_curves_list() (OpenSSL 1.0.2+), this allows to set
colon separated ECDH curve names in SecureContext's ecdhCurve option.
The option can also be set to "auto" to select the curve automatically
from list built in OpenSSL by enabling SSL_CTX_set_ecdh_auto()
(OpenSSL 1.0.2+).

PR-URL: https://github.com/nodejs/node/pull/15206
Ref: https://github.com/nodejs/node/issues/15054
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

1 files changed, 64 insertions, 0 deletions

diff --git a/test/parallel/test-tls-ecdh-auto.js b/test/parallel/test-tls-ecdh-auto.js
new file mode 100644
index 0000000000..eaa7e1da6d
--- /dev/null
+++ b/test/parallel/test-tls-ecdh-auto.js
@@ -0,0 +1,64 @@
+'use strict';
+const common = require('../common');
+
+// This test ensures that the value "auto" on ecdhCurve option is
+// supported to enable automatic curve selection in TLS server.
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+if (!common.opensslCli)
+  common.skip('missing openssl-cli');
+
+const assert = require('assert');
+const tls = require('tls');
+const spawn = require('child_process').spawn;
+const fixtures = require('../common/fixtures');
+
+function loadPEM(n) {
+  return fixtures.readKey(`${n}.pem`);
+}
+
+const options = {
+  key: loadPEM('agent2-key'),
+  cert: loadPEM('agent2-cert'),
+  ciphers: '-ALL:ECDHE-RSA-AES128-SHA256',
+  ecdhCurve: 'auto'
+};
+
+const reply = 'I AM THE WALRUS'; // something recognizable
+
+const server = tls.createServer(options, function(conn) {
+  conn.end(reply);
+});
+
+let gotReply = false;
+
+server.listen(0, function() {
+  const args = ['s_client',
+                '-cipher', `${options.ciphers}`,
+                '-connect', `127.0.0.1:${this.address().port}`];
+
+  // for the performance and stability issue in s_client on Windows
+  if (common.isWindows)
+    args.push('-no_rand_screen');
+
+  const client = spawn(common.opensslCli, args);
+
+  client.stdout.on('data', function(data) {
+    const message = data.toString();
+    if (message.includes(reply))
+      gotReply = true;
+  });
+
+  client.on('exit', function(code) {
+    assert.strictEqual(0, code);
+    server.close();
+  });
+
+  client.on('error', assert.ifError);
+});
+
+process.on('exit', function() {
+  assert.ok(gotReply);
+});