summaryrefslogtreecommitdiff
path: root/lib/tls.js
AgeCommit message (Collapse)AuthorFilesLines
2014-08-29tls: add DHE-RSA-AES128-SHA256 to the def ciphersShigeki Ohtsu1-2/+4
`!EDH` is also removed from the list in the discussion of #8272 Reviewed-By: Fedor Indutny <fedor@indutny.com>
2014-07-02lint: fix indentationTrevor Norris1-2/+2
2014-07-03tls: better error reporting at cert validationFedor Indutny1-2/+28
fix #7417 Signed-off-by: Fedor Indutny <fedor@indutny.com>
2014-06-24tls: using %StringSplit to split `cert.subjectaltname`Yazhong Liu1-6/+9
Signed-off-by: Fedor Indutny <fedor@indutny.com>
2014-03-29crypto: move `createCredentials` to tlsFedor Indutny1-6/+8
Move `createCredentials` to `tls` module and rename it to `createSecureContext`. Make it use default values from `tls` module: `DEFAULT_CIPHERS` and `DEFAULT_ECDH_CURVE`. fix #7249
2013-10-30tls: add ECDH ciphers supportErik Dubbelboer1-0/+2
Switch test fixtures to 1024 bit keys.
2013-08-01src: Replace macros with util functionsisaacs1-4/+4
2013-07-24lib: macro-ify type checksBen Noordhuis1-4/+4
Increases the grep factor. Makes it easier to harmonize type checks across the code base.
2013-07-03tls: export TLSSocketFedor Indutny1-0/+1
2013-06-16tls: introduce TLSSocket based on tls_wrap bindingFedor Indutny1-1251/+16
Split `tls.js` into `_tls_legacy.js`, containing legacy `createSecurePair` API, and `_tls_wrap.js` containing new code based on `tls_wrap` binding. Remove tests that are no longer useful/valid.
2013-05-31Merge remote-tracking branch 'ry/v0.10'isaacs1-22/+33
Conflicts: ChangeLog src/node_version.h
2013-05-30tls: proper .destroySoonFedor Indutny1-22/+33
1. Emit `sslOutEnd` only when `_internallyPendingBytes() === 0`. 2. Read before checking `._halfRead`, otherwise we'll see only previous value, and will invoke `._write` callback improperly. 3. Wait for both `end` and `finish` events in `.destroySoon`. 4. Unpipe encrypted stream from socket to prevent write after destroy.
2013-05-29Merge remote-tracking branch 'origin/v0.10'Ben Noordhuis1-27/+75
Conflicts: deps/uv/ChangeLog deps/uv/src/unix/stream.c deps/uv/src/version.c lib/tls.js
2013-05-28tls: invoke write cb only after opposite read endFedor Indutny1-27/+69
Stream's `._write()` callback should be invoked only after it's opposite stream has finished processing incoming data, otherwise `finish` event fires too early and connection might be closed while there's some data to send to the client. see #5544
2013-05-28tls: ignore .shutdown() syscall errorFedor Indutny1-0/+6
Quote from SSL_shutdown man page: The output of SSL_get_error(3) may be misleading, as an erroneous SSL_ERROR_SYSCALL may be flagged even though no error occurred. Also, handle all other errors to prevent assertion in `ClearError()`.
2013-05-27Merge remote-tracking branch 'ry/v0.10'isaacs1-1/+8
Conflicts: AUTHORS ChangeLog configure deps/uv/ChangeLog deps/uv/src/unix/darwin.c deps/uv/src/unix/stream.c deps/uv/src/version.c deps/v8/src/isolate.cc deps/v8/src/version.cc lib/http.js src/node_version.h
2013-05-24tls: retry writing after hello parse errorFedor Indutny1-1/+8
When writing bad data to EncryptedStream it'll first get to the ClientHello parser, and, only after it will refuse it, to the OpenSSL. But ClientHello parser has limited buffer and therefore write could return `bytes_written` < `incoming_bytes`, which is not the case when working with OpenSSL. After such errors ClientHello parser disables itself and will pass-through all data to the OpenSSL. So just trying to write data one more time will throw the rest into OpenSSL and let it handle it.
2013-05-22timers: use uv_now instead of Date.nowTimothy J Fontaine1-1/+3
This saves a few calls to gettimeofday which can be expensive, and potentially subject to clock drift. Instead use the loop time which uses hrtime internally. fixes #5497
2013-05-21util: Add debuglog, deprecate console lookalikesisaacs1-17/+11
2013-05-20tls: add localAddress and localPort propertiesBen Noordhuis1-0/+11
Add localAddress and localPort properties to tls.CleartextStream. Like remoteAddress and localPort, delegate to the backing net.Socket object. Refs #5502.
2013-04-12Merge branch 'v0.10'Fedor Indutny1-2/+2
Conflicts: ChangeLog deps/uv/src/version.c src/node.h src/node_crypto.cc src/node_crypto_bio.cc src/node_crypto_bio.h src/node_object_wrap.h src/node_version.h
2013-04-07tls: Re-enable check of CN-ID in cert verificationTobias Müllerleile1-2/+2
RFC 6125 explicitly states that a client "MUST NOT seek a match for a reference identifier of CN-ID if the presented identifiers include a DNS-ID, SRV-ID, URI-ID, or any application-specific identifier types supported by the client", but it MAY do so if none of the mentioned identifier types (but others) are present.
2013-04-05Merge remote-tracking branch 'ry/v0.10'isaacs1-0/+6
Conflicts: AUTHORS ChangeLog deps/v8/src/json-parser.h lib/crypto.js src/node_version.h
2013-04-01tls: Destroy socket when encrypted side closesisaacs1-0/+6
The v0.8 Stream.pipe() method automatically destroyed the destination stream whenever the src stream closed. However, this caused a lot of problems, and was removed by popular demand. (Many userland modules still have a no-op destroy() method just because of this.) It was also very hazardous because this would be done even if { end: false } was passed in the pipe options. In v0.10, we decided that the 'close' event and destroy() method are application-specific, and pipe() doesn't automatically call destroy(). However, TLS actually depended (silently) on this behavior. So, in this case, we should just go ahead and destroy the thing when close happens. Closes #5145
2013-03-28Merge remote-tracking branch 'ry/v0.10'isaacs1-12/+14
Conflicts: src/node.cc src/node_version.h
2013-03-28tls: handle SSL_ERROR_ZERO_RETURNFedor Indutny1-3/+7
see #5004
2013-03-27tls: handle errors before calling C++ methodsFedor Indutny1-9/+7
Calling `this.pair.encrypted._internallyPendingBytes()` before handling/resetting error will result in assertion failure: ../src/node_crypto.cc:962: void node::crypto::Connection::ClearError(): Assertion `handle_->Get(String::New("error"))->BooleanValue() == false' failed. see #5058
2013-03-26tls: expose SSL_CTX_set_timeout via tls.createServerManav Rathi1-0/+6
Add the `sessionTimeout` integral value to the list of options recognized by `tls.createServer`. This option will be useful for applications which need frequently establish short-lived TLS connections to the same endpoint. The TLS tickets RFC is an ideal option to reduce the socket setup overhead for such scenarios, but the default ticket timeout value (5 minutes) is too low to be useful.
2013-03-25crypto: make getCiphers() return non-SSL ciphersBen Noordhuis1-0/+11
Commit f53441a added crypto.getCiphers() as a function that returns the names of SSL ciphers. Commit 14a6c4e then added crypto.getHashes(), which returns the names of digest algorithms, but that creates a subtle inconsistency: the return values of crypto.getHashes() are valid arguments to crypto.createHash() but that is not true for crypto.getCiphers() - the returned values are only valid for SSL/TLS functions. Rectify that by adding tls.getCiphers() and making crypto.getCiphers() return proper cipher names.
2013-03-20tls: Prevent hang in readStartisaacs1-1/+4
This is not a great fix, and it's a bug that's very tricky to reproduce. Occasionally, while downloading a file, especially on Linux for some reason, the pause/resume timing will be just right such that the CryptoStream is in a 'reading' state, but actually has no data, so it ought to pull more in. Because there's no reads happening, it just sits there, and the process will exit This is, fundamentally, a factor of how the HTTP implementation sits atop CryptoStreams and TCP Socket objects, which is utterly horrible, and needs to be rewritten. However, in the meantime, npm downloads are prematurely exiting, causing hard-to-debug "cb() never called!" errors.
2013-03-20tls: always reset this.ssl.error after handlingFedor Indutny1-19/+14
Otherwise assertion may happen: src/node_crypto.cc:962: void node::crypto::Connection::ClearError(): Assertion `handle_->Get(String::New("error"))->BooleanValue() == false' failed. See #5058
2013-03-17tls: write pending data of opposite sideFedor Indutny1-0/+1
Fix stucked CryptoStream behaviour, happening when one of the sides locks-up in queued state. fix #5023
2013-03-05stream: _write takes an encoding argumentisaacs1-2/+6
This vastly reduces the overhead of decodeStrings:false streams, such as net and http.
2013-03-05stream: Split Writable logic into small functionsisaacs1-1/+1
1. Get rid of unnecessary 'finishing' flag 2. Dont check both ending and ended. Extraneous. Also: Remove extraneous 'finishing' flag, and don't check both 'ending' and 'ended', since checking just 'ending' is sufficient.
2013-02-28stream: There is no _read cb, there is only pushisaacs1-6/+8
This makes it so that `stream.push(chunk)` is the only way to signal the end of reading, removing the confusing disparity between the callback-style _read method, and the fact that most real-world streams do not have a 1:1 corollation between the "please give me data" event, and the actual arrival of a chunk of data. It is still possible, of course, to implement a `CallbackReadable` on top of this. Simply provide a method like this as the callback: function readCallback(er, chunk) { if (er) stream.emit('error', er); else stream.push(chunk); } However, *only* fs streams actually would behave in this way, so it makes not a lot of sense to make TCP, TLS, HTTP, and all the rest have to bend into this uncomfortable paradigm.
2013-02-21tls: _handle.readStart/readStop for CryptoStreamFedor Indutny1-3/+15
lib/http.js is using stream._handle.readStart/readStop to control data-flow coming out from underlying stream. If this methods are not present - data might be buffered regardless of whether it'll be read. see #4657
2013-02-19tls: Write pending data on socket drainisaacs1-0/+4
Fixes #4800
2013-02-11tls: Cycle data when underlying socket drainsisaacs1-0/+12
2013-02-06tls: port CryptoStream to streams2Fedor Indutny1-386/+280
2013-01-24Add bytesWritten to tls.CryptoStreamAndy Burke1-1/+3
This adds a proxy for bytesWritten to the tls.CryptoStream. This change makes the connection object more similar between HTTP and HTTPS requests in an effort to avoid confusion. See issue #4650 for more background information.
2013-01-24tls: make slab buffer's size configurableFedor Indutny1-2/+5
see #4636
2013-01-14tls: follow RFC6125 more striclyFedor Indutny1-8/+27
* Allow wildcards only in left-most part of hostname identifier. * Do not match CN if altnames are present
2013-01-14tls: allow wildcards in common nameFedor Indutny1-3/+2
see #4592
2012-12-13Merge remote-tracking branch 'ry/v0.8' into masterisaacs1-1/+1
Conflicts: AUTHORS ChangeLog deps/uv/test/test-spawn.c deps/uv/uv.gyp src/cares_wrap.cc src/node.cc src/node_version.h test/simple/test-buffer.js tools/gyp/pylib/gyp/common.py tools/install.py
2012-12-06tls, https: add tls handshake timeoutBen Noordhuis1-1/+17
Don't allow connections to stall indefinitely if the SSL/TLS handshake does not complete. Adds a new tls.Server and https.Server configuration option, handshakeTimeout. Fixes #4355.
2012-11-26tls: fix tls.connect() resource leakBen Noordhuis1-1/+1
The 'secureConnect' event listener was attached with .on(), which blocked it from getting garbage collected. Use .once() instead. Fixes #4308.
2012-11-01doc: tls: rejectUnauthorized defaults to true after 35607f3aGirish Ramakrishnan1-2/+2
2012-10-30tls: delete useless removeListener callBrandon Philips1-1/+0
onclose was never attached to 'end' so this call to remove this listener is useless. Delete it.
2012-10-23tls: Provide buffer to Connection.setSessionisaacs1-1/+4
2012-10-11string_decoder: Add 'end' method, do base64 properlyisaacs1-0/+5
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 05:15:03 +0000