https: throw error if required params missing #3064

kulkarniankita · 2015-09-25T17:01:57Z

throw Error when required parameters for options in https.createServer are missing

The required parameters of https.createServer is key and cert. When these parameters are not provided by the user then a new Error is thrown for the missing parameter.
A subsequent test is also added to verify the same.

This was discussed in Issue: #3024

cc: @jasnell @mhdawson

thefourtheye · 2015-09-25T17:41:50Z

test/parallel/test-httpsServerOptions.js

+  https.createServer(options, function (req, res) {
+    res.send(200);
+  }).listen(common.PORT);
+}, Error);


This test only tests cert case. What about key missing case? It would be better if the error messages are checked explicitly.

Good point. Adding a test case for it as well

thefourtheye · 2015-09-25T17:42:56Z

test/parallel/test-httpsServerOptions.js

+};
+
+assert.throws(function() {
+  https.createServer(options, function (req, res) {


For this usecase, the callback passed should not be called. So, its better to use assert.fail there.

I am curious why the callback passed should not be called?

@kulkarniankita Because the point of the test is to throw on invalid cert option.

Style: function(req, res) {

jasnell · 2015-09-25T17:44:28Z

Marked as semver-major due to the introduction of the new throw.

thefourtheye · 2015-09-25T17:49:37Z

@kulkarniankita As this is your first contribution to this project, you might want to go through https://github.com/nodejs/node/blob/master/CONTRIBUTING.md and fix the commit logs :-)

kulkarniankita · 2015-09-25T21:22:30Z

Because of my issue change, the test-https-pfx.js broke since its asserting on DEPTH_ZERO_SELF_SIGNED_CERT. Should that be fixed to not assert on it anymore and assert on my fix?

srl295 · 2015-09-25T22:02:49Z

@kulkarniankita could test-https-pfx.js just set the cert and key parameters to something valid?

kulkarniankita · 2015-09-26T00:10:45Z

Hi @srl295 yeah adding something valid fixed the test although I am not sure of behaviour change in test-tls-no-cert-required.js as that is failing with the msg that I just added, cert is required there and not provided. There is a comment above that confuses me.

// Omitting the cert or pfx option to tls.createServer() should not throw. // AECDH-NULL-SHA is a no-authentication/no-encryption cipher and hence // doesn't need a certificate. tls.createServer({ ciphers: 'AECDH-NULL-SHA' }).listen(common.PORT, function()

Now this comment means that whenever there is a no-authentication/no-encryption cipher then I should not be asking for a certificate or key. This makes sense so my code should have additional checking for this type of certificate but want to confirm this. (cc: @jasnell )

Fishrock123 · 2015-09-26T01:01:54Z

cc @nodejs/crypto

indutny · 2015-09-26T01:04:42Z

What about ciphers without auth? like aNULL or something like this. They don't require cert at all.

jasnell · 2015-09-26T01:28:17Z

@indutny... Is there a concise list of known ciphers that do/don't require
cert/key?
On Sep 25, 2015 6:04 PM, "Fedor Indutny" [email protected] wrote:

What about ciphers without auth? like aNULL or something like this. They
don't require cert at all.

—
Reply to this email directly or view it on GitHub
#3064 (comment).

indutny · 2015-09-26T01:30:14Z

@jasnell of course!

$ ./out/Release/openssl-cli ciphers -v aNULL
AECDH-AES256-SHA        SSLv3 Kx=ECDH     Au=None Enc=AES(256)  Mac=SHA1
ADH-AES256-GCM-SHA384   TLSv1.2 Kx=DH       Au=None Enc=AESGCM(256) Mac=AEAD
ADH-AES256-SHA256       TLSv1.2 Kx=DH       Au=None Enc=AES(256)  Mac=SHA256
ADH-AES256-SHA          SSLv3 Kx=DH       Au=None Enc=AES(256)  Mac=SHA1
ADH-CAMELLIA256-SHA     SSLv3 Kx=DH       Au=None Enc=Camellia(256) Mac=SHA1
AECDH-AES128-SHA        SSLv3 Kx=ECDH     Au=None Enc=AES(128)  Mac=SHA1
ADH-AES128-GCM-SHA256   TLSv1.2 Kx=DH       Au=None Enc=AESGCM(128) Mac=AEAD
ADH-AES128-SHA256       TLSv1.2 Kx=DH       Au=None Enc=AES(128)  Mac=SHA256
ADH-AES128-SHA          SSLv3 Kx=DH       Au=None Enc=AES(128)  Mac=SHA1
ADH-SEED-SHA            SSLv3 Kx=DH       Au=None Enc=SEED(128) Mac=SHA1
ADH-CAMELLIA128-SHA     SSLv3 Kx=DH       Au=None Enc=Camellia(128) Mac=SHA1
AECDH-RC4-SHA           SSLv3 Kx=ECDH     Au=None Enc=RC4(128)  Mac=SHA1
ADH-RC4-MD5             SSLv3 Kx=DH       Au=None Enc=RC4(128)  Mac=MD5
AECDH-DES-CBC3-SHA      SSLv3 Kx=ECDH     Au=None Enc=3DES(168) Mac=SHA1
ADH-DES-CBC3-SHA        SSLv3 Kx=DH       Au=None Enc=3DES(168) Mac=SHA1
ADH-DES-CBC-SHA         SSLv3 Kx=DH       Au=None Enc=DES(56)   Mac=SHA1
EXP-ADH-DES-CBC-SHA     SSLv3 Kx=DH(512)  Au=None Enc=DES(40)   Mac=SHA1 export
EXP-ADH-RC4-MD5         SSLv3 Kx=DH(512)  Au=None Enc=RC4(40)   Mac=MD5  export
AECDH-NULL-SHA          SSLv3 Kx=ECDH     Au=None Enc=None      Mac=SHA1

indutny · 2015-09-26T01:30:24Z

@jasnell I hope you don't suggest hard-coding this?

jasnell · 2015-09-26T01:33:57Z

No, I'm just trying to determine if there's some reasonable algorithmic way
to determine if the cert or key are required or not. If not, then we may
just have to punt on doing the check this way
On Sep 25, 2015 6:30 PM, "Fedor Indutny" [email protected] wrote:

@jasnell https://github.com/jasnell I hope you don't suggest
hard-coding this?

—
Reply to this email directly or view it on GitHub
#3064 (comment).

thefourtheye · 2015-09-26T04:29:03Z

So this behavior is actually the expected behavior. @indutny What about the certificate check? I think that can stay. Right?

indutny · 2015-09-26T04:34:14Z

@thefourtheye not really aNULL does not really need neither key nor cert.

kulkarniankita · 2015-09-26T04:42:36Z

I notice there is a getCiphers method in crypto module. Wondering if anywhere in the existing code, it checks for aNull type of check.

thefourtheye · 2015-09-26T04:43:22Z

@indutny oh, I wonder how the connection is encrypted and validations happen then.

indutny · 2015-09-26T04:49:47Z

@thefourtheye it is using either ephemeral Diffie-Hellman, or not encrypting it at all.

indutny · 2015-09-26T04:52:55Z

@kulkarniankita I think we can try iterating through ciphers and checking:

The string returned by SSL_CIPHER_description() in case of success consists of cleartext information separated by one or more blanks in the following sequence:

       <ciphername>
           Textual representation of the cipher name.

       <protocol version>
           Protocol version: SSLv2, SSLv3, TLSv1.2. The TLSv1.0 ciphers are flagged with SSLv3. No new ciphers were added by TLSv1.1.

       Kx=<key exchange>
           Key exchange method: RSA (for export ciphers as RSA(512) or RSA(1024)), DH (for export ciphers as DH(512) or DH(1024)), DH/RSA, DH/DSS, Fortezza.

       Au=<authentication>
           Authentication method: RSA, DSS, DH, None. None is the representation of anonymous ciphers.

       Enc=<symmetric encryption method>
           Encryption method with number of secret bits: DES(40), DES(56), 3DES(168), RC4(40), RC4(56), RC4(64), RC4(128), RC2(40), RC2(56), RC2(128), IDEA(128), Fortezza, None.

       Mac=<message authentication code>
           Message digest: MD5, SHA1.

       <export flag>
           If the cipher is flagged exportable with respect to old US crypto regulations, the word "export" is printed.

If Au=None - cert is not required.

Or, as a simpler fix! We can check if used cipher list is a default one, and throw an error like you do in this PR. This will protect users from most common errors, while keeping the Au=None ciphers work just fine for those who need them.

indutny · 2015-09-26T04:53:09Z

lib/_tls_wrap.js

@@ -846,10 +846,23 @@ Server.prototype.setOptions = function(options) {
    this.rejectUnauthorized = false;
  }

+


Unnecessary newline.

thefourtheye · 2015-09-26T04:56:24Z

@indutny Oh... I guess if server and client are not able to come to an agreement about the algorithm to be used, then they ll fall back to any of the null mechanisms. Is that correct?

Apart from that, this patch is not necessary as it is trying to fix something which is actually the expected behavior right? I suppose we can close this then.

@kulkarniankita thanks for the contribution. I am sorry that this patch didnt make it in. Please feel free to discuss further if needed.

thefourtheye · 2015-09-26T04:59:11Z

Oops sorry. Missed @indutny's suggestions. Reopening now.

jasnell · 2015-10-26T21:44:15Z

Looks good on initial read but I'd like to get @indutny and @shigeki to take a final look.

shigeki · 2015-10-27T08:57:47Z

This is bad when option.pfx is used. The PKCS#12 file contains cert and key data so that option.cert and option.key are not needed. That's why the pfx test does not have them. The check should be skipped if it has option.pfx.

Throw an error when required parameters are missing. Handles ciphers that requires no auth. Does not throw error If pfx option is provided. Additional tests added for the same. Fixes: nodejs#3024 PR-URL: nodejs#3064

cbshakumar · 2015-12-09T13:22:52Z

lib/_tls_wrap.js

+  } else {
+    this.cert = options.cert;
+  }
+
  if (options.ca) this.ca = options.ca;


What happens if I want to set the certificate authority for reading only but not the cert/private key.
Example: http://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html

@cbshakumar you mean if cert authority is provided then skip this whole cert/key error handling right?

@kulkarniankita It has been a while since I've looked at this. Should it be possible to set the certificate authority and not set a cert?

jasnell · 2017-02-28T22:57:02Z

Given the lack of forward progress and the uncertainty of what the actual behavior should be, I'm closing. This can be reopened if necessary

thefourtheye added the https Issues or PRs related to the https subsystem. label Sep 25, 2015

thefourtheye reviewed Sep 25, 2015
View reviewed changes

jasnell added the semver-major PRs that contain breaking changes and should be released in the next major version. label Sep 25, 2015

thefourtheye reviewed Sep 25, 2015
View reviewed changes

indutny reviewed Sep 26, 2015
View reviewed changes

thefourtheye closed this Sep 26, 2015

thefourtheye reopened this Sep 26, 2015

kulkarniankita force-pushed the master branch from 4f7f022 to f49d519 Compare November 6, 2015 02:31

kulkarniankita force-pushed the master branch from f49d519 to fae020e Compare November 6, 2015 02:55

https: throw Error if required params missing

fae020e

Throw an error when required parameters are missing. Handles ciphers that requires no auth. Does not throw error If pfx option is provided. Additional tests added for the same. Fixes: nodejs#3024 PR-URL: nodejs#3064

cbshakumar reviewed Dec 9, 2015
View reviewed changes

Trott force-pushed the master branch from 1e896a6 to 082cc8d Compare December 27, 2015 02:00

jasnell added the stalled Issues and PRs that are stalled. label Mar 22, 2016

estliberitas force-pushed the master branch 2 times, most recently from 7da4fd4 to c7066fb Compare April 26, 2016 05:22

Trott mentioned this pull request May 3, 2016

Possibly Trivial HTTPS Options Issue #3024

Closed

Trott force-pushed the master branch from b0df363 to c5ce7f4 Compare September 21, 2016 00:09

rvagg force-pushed the master branch 2 times, most recently from c133999 to 83c7a88 Compare October 18, 2016 17:01

MylesBorins force-pushed the master branch from 8df7ee0 to 54fef67 Compare February 1, 2017 01:00

jasnell closed this Feb 28, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

https: throw error if required params missing #3064

https: throw error if required params missing #3064

kulkarniankita commented Sep 25, 2015

thefourtheye Sep 25, 2015

kulkarniankita Sep 25, 2015

thefourtheye Sep 25, 2015

kulkarniankita Sep 25, 2015

thefourtheye Sep 25, 2015

indutny Sep 26, 2015

jasnell commented Sep 25, 2015

thefourtheye commented Sep 25, 2015

kulkarniankita commented Sep 25, 2015

srl295 commented Sep 25, 2015

kulkarniankita commented Sep 26, 2015

Fishrock123 commented Sep 26, 2015

indutny commented Sep 26, 2015

jasnell commented Sep 26, 2015

indutny commented Sep 26, 2015

indutny commented Sep 26, 2015

jasnell commented Sep 26, 2015

thefourtheye commented Sep 26, 2015

indutny commented Sep 26, 2015

kulkarniankita commented Sep 26, 2015

thefourtheye commented Sep 26, 2015

indutny commented Sep 26, 2015

indutny commented Sep 26, 2015

indutny Sep 26, 2015

thefourtheye commented Sep 26, 2015

thefourtheye commented Sep 26, 2015

jasnell commented Oct 26, 2015

shigeki commented Oct 27, 2015

cbshakumar Dec 9, 2015

kulkarniankita May 5, 2016

cbshakumar May 5, 2016

jasnell commented Feb 28, 2017

		@@ -846,10 +846,23 @@ Server.prototype.setOptions = function(options) {
		this.rejectUnauthorized = false;
		}

https: throw error if required params missing #3064

https: throw error if required params missing #3064

Conversation

kulkarniankita commented Sep 25, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jasnell commented Sep 25, 2015

thefourtheye commented Sep 25, 2015

kulkarniankita commented Sep 25, 2015

srl295 commented Sep 25, 2015

kulkarniankita commented Sep 26, 2015

Fishrock123 commented Sep 26, 2015

indutny commented Sep 26, 2015

jasnell commented Sep 26, 2015

indutny commented Sep 26, 2015

indutny commented Sep 26, 2015

jasnell commented Sep 26, 2015

thefourtheye commented Sep 26, 2015

indutny commented Sep 26, 2015

kulkarniankita commented Sep 26, 2015

thefourtheye commented Sep 26, 2015

indutny commented Sep 26, 2015

indutny commented Sep 26, 2015

Choose a reason for hiding this comment

thefourtheye commented Sep 26, 2015

thefourtheye commented Sep 26, 2015

jasnell commented Oct 26, 2015

shigeki commented Oct 27, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jasnell commented Feb 28, 2017