summaryrefslogtreecommitdiff
path: root/src/node_crypto_clienthello.h
AgeCommit message (Collapse)Author
2019-03-20tls: support TLSv1.3Sam Roberts
This introduces TLS1.3 support and makes it the default max protocol, but also supports CLI/NODE_OPTIONS switches to disable it if necessary. TLS1.3 is a major update to the TLS protocol, with many security enhancements. It should be preferred over TLS1.2 whenever possible. TLS1.3 is different enough that even though the OpenSSL APIs are technically API/ABI compatible, that when TLS1.3 is negotiated, the timing of protocol records and of callbacks broke assumptions hard-coded into the 'tls' module. This change introduces no API incompatibilities when TLS1.2 is negotiated. It is the intention that it be backported to current and LTS release lines with the default maximum TLS protocol reset to 'TLSv1.2'. This will allow users of those lines to explicitly enable TLS1.3 if they want. API incompatibilities between TLS1.2 and TLS1.3 are: - Renegotiation is not supported by TLS1.3 protocol, attempts to call `.renegotiate()` will always fail. - Compiling against a system OpenSSL lower than 1.1.1 is no longer supported (OpenSSL-1.1.0 used to be supported with configure flags). - Variations of `conn.write('data'); conn.destroy()` have undefined behaviour according to the streams API. They may or may not send the 'data', and may or may not cause a ERR_STREAM_DESTROYED error to be emitted. This has always been true, but conditions under which the write suceeds is slightly but observably different when TLS1.3 is negotiated vs when TLS1.2 or below is negotiated. - If TLS1.3 is negotiated, and a server calls `conn.end()` in its 'secureConnection' listener without any data being written, the client will not receive session tickets (no 'session' events will be emitted, and `conn.getSession()` will never return a resumable session). - The return value of `conn.getSession()` API may not return a resumable session if called right after the handshake. The effect will be that clients using the legacy `getSession()` API will resume sessions if TLS1.2 is negotiated, but will do full handshakes if TLS1.3 is negotiated. See https://github.com/nodejs/node/pull/25831 for more information. PR-URL: https://github.com/nodejs/node/pull/26209 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org>
2019-02-27src: apply clang-tidy rule modernize-deprecated-headersgengjiawen
PR-URL: https://github.com/nodejs/node/pull/26159 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
2019-01-29src: in-source comments and minor TLS cleanupsSam Roberts
Renamed some internal C++ methods and properties for consistency, and commented SSL I/O. - Rename waiting_new_session_ after is_waiting_new_session(), instead of using reverse naming (new_session_wait_), and change "waiting" to "awaiting". - Make TLSWrap::ClearIn() return void, the value is never used. - Fix a getTicketKeys() cut-n-paste error. Since it doesn't use the arguments, remove them from the js wrapper. - Remove call of setTicketKeys(getTicketKeys()), its a no-op. PR-URL: https://github.com/nodejs/node/pull/25713 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2018-12-28tls: remove unused ocsp extension parsingSam Roberts
The OCSP info from parsing the TLS ClientHello has not been used since 550c263, remove it. See: https://github.com/nodejs/node/pull/1464 PR-URL: https://github.com/nodejs/node/pull/25153 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
2018-10-15crypto: move field initialization to classDiana Holland
PR-URL: https://github.com/nodejs/node/pull/23610 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com> Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Ujjwal Sharma <usharma1998@gmail.com>
2017-12-19crypto: remove unused header in clienthello.hDaniel Bevenius
This commit removes stdlib.h header as it does not seem to be used any more. PR-URL: https://github.com/nodejs/node/pull/17752 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
2017-12-15src: fix -Wundefined-inline warningsBen Noordhuis
Fix compiler warnings introduced in commit 47edfd9c3c ("crypto: move node_crypto_clienthello-inl.h to cc") by moving constructors around. They were defined inline but depended on definitions from `node_crypto_clienthello-inl.h`. PR-URL: https://github.com/nodejs/node/pull/17649 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Timothy Gu <timothygu99@gmail.com> Reviewed-By: Eugene Ostroukhov <eostroukhov@google.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2017-12-11src: remove unused include node_crypto_clienthelloDaniel Bevenius
This commit removes the include of node.h which does not seem to be used. PR-URL: https://github.com/nodejs/node/pull/17546 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
2017-06-30src: move crypto_bio/clienthello to crypto nsDaniel Bevenius
Currently, node_crypto_bio and node_crypto_clienthello are not in the crypto namespace but simply in the node namespace. Not sure if this was intentional or not, but I think it would make sense to move them to be consistent. PR-URL: https://github.com/nodejs/node/pull/13957 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com>
2017-03-10meta: restore original copyright headerJames M Snell
A prior io.js era commit inappropriately removed the original copyright statements from the source. This restores those in any files still remaining from that edit. Ref: https://github.com/nodejs/TSC/issues/174 Ref: https://github.com/nodejs/node/pull/10599 PR-URL: https://github.com/nodejs/node/pull/10155 Note: This PR was required, reviewed-by and approved by the Node.js Foundation Legal Committee and the TSC. There is no `Approved-By:` meta data.
2016-07-11crypto: fix undefined behavior in ParseExtensionFedor Indutny
Many extensions are unknown to the `ClientHelloParser::ParseExtension`, do not cast user-supplied `uint16_t` to `enum`. PR-URL: https://github.com/nodejs/node/pull/7494 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2016-05-25src: add include guards to internal headersBen Noordhuis
For consistency with the newly added src/base64.h header, check that NODE_WANT_INTERNALS is defined and set in internal headers. PR-URL: https://github.com/nodejs/node/pull/6948 Refs: https://github.com/nodejs/node/pull/6910 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Trevor Norris <trev.norris@gmail.com>
2015-01-12Remove excessive copyright/license boilerplateisaacs
The copyright and license notice is already in the LICENSE file. There is no justifiable reason to also require that it be included in every file, since the individual files are not individually distributed except as part of the entire package.
2015-01-11build,src: remove sslv2 supportBen Noordhuis
SSLv2 has been deprecated and known broken for nearly twenty years now. I made SSLv2 support opt-in well over a year ago in commit 39aa894 and now this commit removes it entirely. PR-URL: https://github.com/iojs/io.js/pull/290 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Rod Vagg <rod@vagg.org>
2014-10-23src: mark empty destructors as defaultBen Noordhuis
Mark empty destructors as having a default no-op implementation. Remove a few unused constructors and destructors while we are here.
2014-10-23src: replace NULL with nullptrBen Noordhuis
Now that we are building with C++11 features enabled, replace use of NULL with nullptr. The benefit of using nullptr is that it can never be confused for an integral type because it does not support implicit conversions to integral types except boolean - unlike NULL, which is defined as a literal `0`.
2014-04-18tls: support OCSP on client and serverFedor Indutny
2013-08-06tls: asynchronous SNICallbackFedor Indutny
Make ClientHelloParser handle SNI extension, and extend `_tls_wrap.js` to support loading SNI Context from both hello, and resumed session. fix #5967
2013-08-06tls_wrap: DRY ClientHelloParserFedor Indutny
Share ClientHelloParser code between `tls_wrap.cc` and `node_crypto.cc`. fix #5959
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-12 21:03:15 +0000