|
| 1 | +// Copyright Joyent, Inc. and other Node contributors. |
| 2 | +// |
| 3 | +// Permission is hereby granted, free of charge, to any person obtaining a |
| 4 | +// copy of this software and associated documentation files (the |
| 5 | +// "Software"), to deal in the Software without restriction, including |
| 6 | +// without limitation the rights to use, copy, modify, merge, publish, |
| 7 | +// distribute, sublicense, and/or sell copies of the Software, and to permit |
| 8 | +// persons to whom the Software is furnished to do so, subject to the |
| 9 | +// following conditions: |
| 10 | +// |
| 11 | +// The above copyright notice and this permission notice shall be included |
| 12 | +// in all copies or substantial portions of the Software. |
| 13 | +// |
| 14 | +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS |
| 15 | +// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
| 16 | +// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN |
| 17 | +// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, |
| 18 | +// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR |
| 19 | +// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE |
| 20 | +// USE OR OTHER DEALINGS IN THE SOFTWARE. |
| 21 | + |
| 22 | +var common = require('../common'); |
| 23 | +var assert = require('assert'); |
| 24 | +var tls = require('tls'); |
| 25 | +var fs = require('fs'); |
| 26 | +var nconns = 0; |
| 27 | +var SSL_Method = 'SSLv23_method'; |
| 28 | +var localhost = '127.0.0.1'; |
| 29 | +var opCipher = process.binding('constants').SSL_OP_CIPHER_SERVER_PREFERENCE; |
| 30 | + |
| 31 | +/* |
| 32 | + * This test is to make sure we are preserving secureOptions that are passed |
| 33 | + * to the server. |
| 34 | + * |
| 35 | + * Also that if honorCipherOrder is passed we are preserving that in the |
| 36 | + * options. |
| 37 | + * |
| 38 | + * And that if we are passing in secureOptions no new options (aside from the |
| 39 | + * honorCipherOrder case) are added to the secureOptions |
| 40 | + */ |
| 41 | + |
| 42 | + |
| 43 | +process.on('exit', function() { |
| 44 | + assert.equal(nconns, 6); |
| 45 | +}); |
| 46 | + |
| 47 | +function test(honorCipherOrder, clientCipher, expectedCipher, secureOptions, cb) { |
| 48 | + var soptions = { |
| 49 | + secureProtocol: SSL_Method, |
| 50 | + key: fs.readFileSync(common.fixturesDir + '/keys/agent2-key.pem'), |
| 51 | + cert: fs.readFileSync(common.fixturesDir + '/keys/agent2-cert.pem'), |
| 52 | + ciphers: 'AES256-SHA:RC4-SHA:DES-CBC-SHA', |
| 53 | + secureOptions: secureOptions, |
| 54 | + honorCipherOrder: !!honorCipherOrder |
| 55 | + }; |
| 56 | + |
| 57 | + var server = tls.createServer(soptions, function(cleartextStream) { |
| 58 | + nconns++; |
| 59 | + }); |
| 60 | + |
| 61 | + if (!!honorCipherOrder) { |
| 62 | + assert.strictEqual(server.secureOptions & opCipher, opCipher, 'we should preserve cipher preference'); |
| 63 | + } |
| 64 | + |
| 65 | + if (secureOptions) { |
| 66 | + var expectedSecureOpts = secureOptions; |
| 67 | + if (!!honorCipherOrder) expectedSecureOpts |= opCipher; |
| 68 | + |
| 69 | + assert.strictEqual(server.secureOptions & expectedSecureOpts, |
| 70 | + expectedSecureOpts, 'we should preserve secureOptions'); |
| 71 | + assert.strictEqual(server.secureOptions & ~expectedSecureOpts, |
| 72 | + 0, |
| 73 | + 'we should not add extra options'); |
| 74 | + } |
| 75 | + |
| 76 | + server.listen(common.PORT, localhost, function() { |
| 77 | + var coptions = { |
| 78 | + rejectUnauthorized: false, |
| 79 | + secureProtocol: SSL_Method |
| 80 | + }; |
| 81 | + if (clientCipher) { |
| 82 | + coptions.ciphers = clientCipher; |
| 83 | + } |
| 84 | + var client = tls.connect(common.PORT, localhost, coptions, function() { |
| 85 | + var cipher = client.getCipher(); |
| 86 | + client.end(); |
| 87 | + server.close(); |
| 88 | + assert.equal(cipher.name, expectedCipher); |
| 89 | + if (cb) cb(); |
| 90 | + }); |
| 91 | + }); |
| 92 | +} |
| 93 | + |
| 94 | +test1(); |
| 95 | + |
| 96 | +function test1() { |
| 97 | + // Client has the preference of cipher suites by default |
| 98 | + test(false, 'DES-CBC-SHA:RC4-SHA:AES256-SHA','DES-CBC-SHA', 0, test2); |
| 99 | +} |
| 100 | + |
| 101 | +function test2() { |
| 102 | + // Server has the preference of cipher suites where AES256-SHA is in |
| 103 | + // the first. |
| 104 | + test(true, 'DES-CBC-SHA:RC4-SHA:AES256-SHA', 'AES256-SHA', 0, test3); |
| 105 | +} |
| 106 | + |
| 107 | +function test3() { |
| 108 | + // Server has the preference of cipher suites. RC4-SHA is given |
| 109 | + // higher priority over DES-CBC-SHA among client cipher suites. |
| 110 | + test(true, 'DES-CBC-SHA:RC4-SHA', 'RC4-SHA', 0, test4); |
| 111 | +} |
| 112 | + |
| 113 | +function test4() { |
| 114 | + // As client has only one cipher, server has no choice in regardless |
| 115 | + // of honorCipherOrder. |
| 116 | + test(true, 'DES-CBC-SHA', 'DES-CBC-SHA', 0, test5); |
| 117 | +} |
| 118 | + |
| 119 | +function test5() { |
| 120 | + test(false, |
| 121 | + 'DES-CBC-SHA', |
| 122 | + 'DES-CBC-SHA', |
| 123 | + process.binding('constants').SSL_OP_SINGLE_DH_USE, test6); |
| 124 | +} |
| 125 | + |
| 126 | +function test6() { |
| 127 | + test(true, |
| 128 | + 'DES-CBC-SHA', |
| 129 | + 'DES-CBC-SHA', |
| 130 | + process.binding('constants').SSL_OP_SINGLE_DH_USE); |
| 131 | +} |
0 commit comments