|
| 1 | +'use strict'; |
| 2 | + |
| 3 | +// A connection's secure context - its certificate, and the CAs it checks client |
| 4 | +// certificates against - is chosen from the server name of its first client |
| 5 | +// hello, but a connection can do multiple hellos: a TLS 1.2 renegotiation, or |
| 6 | +// a TLS 1.3 HelloRetryRequest. These later client hellos must not be allowed |
| 7 | +// to subsequently change the server name, since it can associate state and |
| 8 | +// authorization (mTLS) from one SNI with another, unexpectedly. |
| 9 | +// |
| 10 | +// Node's own client can't change the name mid-connection, so the client here |
| 11 | +// drives the TLS library directly over memory BIOs, leaving the socket I/O to |
| 12 | +// node:net. |
| 13 | + |
| 14 | +const common = require('../common'); |
| 15 | + |
| 16 | +if (!common.hasCrypto) |
| 17 | + common.skip('missing crypto'); |
| 18 | + |
| 19 | +common.skipIfFFIMissing(); |
| 20 | + |
| 21 | +if (common.isWindows) |
| 22 | + common.skip('dlopen(null) is not supported on Windows'); |
| 23 | + |
| 24 | +// SSL_ctrl() and SSL_CTX_ctrl() take and return a C `long`, which node:ffi has |
| 25 | +// no type for, so they're declared below as i64, which it only is on 64-bit. |
| 26 | +if (['ia32', 'arm'].includes(process.arch)) |
| 27 | + common.skip('a C long is not 64 bits here'); |
| 28 | + |
| 29 | +// The SSL_ctrl() command numbers below are OpenSSL's, and BoringSSL neither |
| 30 | +// renegotiates nor reads the server name of a second ClientHello. |
| 31 | +// BoringSSL guards against the whole class of errors internally anyway, and |
| 32 | +// the FFI implementation for testing below is OpenSSL specific: |
| 33 | +if (require('../common/crypto').isBoringSSL) |
| 34 | + common.skip('OpenSSL-specific'); |
| 35 | + |
| 36 | +const assert = require('node:assert'); |
| 37 | +const net = require('node:net'); |
| 38 | +const tls = require('node:tls'); |
| 39 | +const fixtures = require('../common/fixtures'); |
| 40 | +const { dlopen } = require('node:ffi'); |
| 41 | + |
| 42 | +const SSL_CTRL_SET_TLSEXT_HOSTNAME = 55; |
| 43 | +const SSL_CTRL_SET_MAX_PROTO_VERSION = 124; |
| 44 | +const TLSEXT_NAMETYPE_host_name = 0n; |
| 45 | +const TLS1_2_VERSION = 0x0303n; |
| 46 | +const SSL_ERROR_WANT_READ = 2; |
| 47 | +const SSL_ERROR_WANT_WRITE = 3; |
| 48 | + |
| 49 | +// Node's own OpenSSL, resolved out of the running process rather than loaded |
| 50 | +// from the system. |
| 51 | +const { functions: ssl } = dlopen(null, { |
| 52 | + TLS_client_method: { arguments: [], return: 'pointer' }, |
| 53 | + SSL_CTX_new: { arguments: ['pointer'], return: 'pointer' }, |
| 54 | + SSL_CTX_free: { arguments: ['pointer'], return: 'void' }, |
| 55 | + SSL_CTX_ctrl: { arguments: ['pointer', 'i32', 'i64', 'pointer'], return: 'i64' }, |
| 56 | + SSL_new: { arguments: ['pointer'], return: 'pointer' }, |
| 57 | + SSL_free: { arguments: ['pointer'], return: 'void' }, |
| 58 | + SSL_ctrl: { arguments: ['pointer', 'i32', 'i64', 'string'], return: 'i64' }, |
| 59 | + SSL_set_bio: { arguments: ['pointer', 'pointer', 'pointer'], return: 'void' }, |
| 60 | + SSL_set_connect_state: { arguments: ['pointer'], return: 'void' }, |
| 61 | + SSL_do_handshake: { arguments: ['pointer'], return: 'i32' }, |
| 62 | + SSL_renegotiate: { arguments: ['pointer'], return: 'i32' }, |
| 63 | + SSL_get_error: { arguments: ['pointer', 'i32'], return: 'i32' }, |
| 64 | + SSL_get1_session: { arguments: ['pointer'], return: 'pointer' }, |
| 65 | + SSL_set_session: { arguments: ['pointer', 'pointer'], return: 'i32' }, |
| 66 | + SSL_session_reused: { arguments: ['pointer'], return: 'i32' }, |
| 67 | + SSL_SESSION_free: { arguments: ['pointer'], return: 'void' }, |
| 68 | + BIO_s_mem: { arguments: [], return: 'pointer' }, |
| 69 | + BIO_new: { arguments: ['pointer'], return: 'pointer' }, |
| 70 | + BIO_read: { arguments: ['pointer', 'buffer', 'i32'], return: 'i32' }, |
| 71 | + BIO_write: { arguments: ['pointer', 'buffer', 'i32'], return: 'i32' }, |
| 72 | +}); |
| 73 | + |
| 74 | +// A client whose records are carried by a plain socket. The server name is |
| 75 | +// settable at any point, which is the whole reason for this class. |
| 76 | +class RawClient { |
| 77 | + constructor({ tls12Only = false, session } = {}) { |
| 78 | + this.ctx = ssl.SSL_CTX_new(ssl.TLS_client_method()); |
| 79 | + if (tls12Only) { |
| 80 | + ssl.SSL_CTX_ctrl(this.ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, TLS1_2_VERSION, null); |
| 81 | + } |
| 82 | + this.ssl = ssl.SSL_new(this.ctx); |
| 83 | + if (session) ssl.SSL_set_session(this.ssl, session); |
| 84 | + this.rbio = ssl.BIO_new(ssl.BIO_s_mem()); |
| 85 | + this.wbio = ssl.BIO_new(ssl.BIO_s_mem()); |
| 86 | + // SSL_set_bio() takes ownership of both, so SSL_free() releases them. |
| 87 | + ssl.SSL_set_bio(this.ssl, this.rbio, this.wbio); |
| 88 | + ssl.SSL_set_connect_state(this.ssl); |
| 89 | + |
| 90 | + this.buf = Buffer.alloc(16 * 1024); |
| 91 | + this.incoming = []; |
| 92 | + this.notify = null; |
| 93 | + this.ended = false; |
| 94 | + this.socket = net.connect(server.address().port, '127.0.0.1'); |
| 95 | + this.socket.on('data', (chunk) => { |
| 96 | + this.incoming.push(chunk); |
| 97 | + this.wake(); |
| 98 | + }); |
| 99 | + this.socket.on('close', () => { |
| 100 | + this.ended = true; |
| 101 | + this.wake(); |
| 102 | + }); |
| 103 | + this.socket.on('error', () => {}); |
| 104 | + this.connected = new Promise((resolve) => this.socket.once('connect', resolve)); |
| 105 | + } |
| 106 | + |
| 107 | + wake() { |
| 108 | + const notify = this.notify; |
| 109 | + this.notify = null; |
| 110 | + notify?.(); |
| 111 | + } |
| 112 | + |
| 113 | + // A null name clears it, so the next ClientHello carries no extension. |
| 114 | + setServername(name) { |
| 115 | + ssl.SSL_ctrl(this.ssl, SSL_CTRL_SET_TLSEXT_HOSTNAME, TLSEXT_NAMETYPE_host_name, name); |
| 116 | + } |
| 117 | + |
| 118 | + // Everything the TLS library has produced goes out on the socket. |
| 119 | + flush() { |
| 120 | + for (;;) { |
| 121 | + const read = ssl.BIO_read(this.wbio, this.buf, this.buf.length); |
| 122 | + if (read <= 0) break; |
| 123 | + this.socket.write(Buffer.from(this.buf.subarray(0, read))); |
| 124 | + } |
| 125 | + } |
| 126 | + |
| 127 | + // Hands the library the next thing to arrive, false once nothing more will. |
| 128 | + async feed() { |
| 129 | + while (this.incoming.length === 0) { |
| 130 | + if (this.ended) return false; |
| 131 | + await new Promise((resolve) => { this.notify = resolve; }); |
| 132 | + } |
| 133 | + const chunk = this.incoming.shift(); |
| 134 | + ssl.BIO_write(this.rbio, chunk, chunk.length); |
| 135 | + return true; |
| 136 | + } |
| 137 | + |
| 138 | + // `afterFirstRead` runs once the library has been handed the server's first |
| 139 | + // flight but before it has written anything in reply. For a TLS 1.3 |
| 140 | + // HelloRetryRequest that is the gap between the two ClientHellos. |
| 141 | + async handshake(afterFirstRead) { |
| 142 | + let reads = 0; |
| 143 | + for (;;) { |
| 144 | + const result = ssl.SSL_do_handshake(this.ssl); |
| 145 | + this.flush(); |
| 146 | + if (result === 1) return true; |
| 147 | + const error = ssl.SSL_get_error(this.ssl, result); |
| 148 | + if (error !== SSL_ERROR_WANT_READ && error !== SSL_ERROR_WANT_WRITE) return false; |
| 149 | + if (!await this.feed()) return false; |
| 150 | + if (++reads === 1) afterFirstRead?.(); |
| 151 | + } |
| 152 | + } |
| 153 | + |
| 154 | + async renegotiate() { |
| 155 | + if (ssl.SSL_renegotiate(this.ssl) !== 1) return false; |
| 156 | + return this.handshake(); |
| 157 | + } |
| 158 | + |
| 159 | + close() { |
| 160 | + this.socket.destroy(); |
| 161 | + ssl.SSL_free(this.ssl); |
| 162 | + ssl.SSL_CTX_free(this.ctx); |
| 163 | + } |
| 164 | +} |
| 165 | + |
| 166 | +const server = tls.createServer({ |
| 167 | + key: fixtures.readKey('agent2-key.pem'), |
| 168 | + cert: fixtures.readKey('agent2-cert.pem'), |
| 169 | + // Offering only this group makes the server answer a TLS 1.3 client, whose |
| 170 | + // first key share is for a different curve, with a HelloRetryRequest. |
| 171 | + ecdhCurve: 'P-521', |
| 172 | +}, (socket) => { |
| 173 | + socket.on('error', () => {}); |
| 174 | + socket.resume(); |
| 175 | +}); |
| 176 | +server.on('tlsClientError', () => {}); |
| 177 | + |
| 178 | +// Do a set of TLS 1.2 handshakes, asking for SNI `first` (or null) then |
| 179 | +// renegotiating for SNI `second` (or null), and returning whether that |
| 180 | +// was accepted. If `resume` is set, the `first` session is a resumption. |
| 181 | +async function renegotiating(first, second, { resume = false } = {}) { |
| 182 | + let session = null; |
| 183 | + let issuer = null; |
| 184 | + if (resume) { |
| 185 | + // The session must be used before the client it came from is closed: |
| 186 | + // freeing that client's context makes its sessions unresumable. |
| 187 | + issuer = new RawClient({ tls12Only: true }); |
| 188 | + await issuer.connected; |
| 189 | + issuer.setServername(first); |
| 190 | + assert.strictEqual(await issuer.handshake(), true); |
| 191 | + session = ssl.SSL_get1_session(issuer.ssl); |
| 192 | + } |
| 193 | + const client = new RawClient({ tls12Only: true, session }); |
| 194 | + await client.connected; |
| 195 | + client.setServername(first); |
| 196 | + assert.strictEqual(await client.handshake(), true); |
| 197 | + assert.strictEqual(ssl.SSL_session_reused(client.ssl) === 1, resume); |
| 198 | + client.setServername(second); |
| 199 | + const accepted = await client.renegotiate(); |
| 200 | + client.close(); |
| 201 | + if (resume) { |
| 202 | + issuer.close(); |
| 203 | + ssl.SSL_SESSION_free(session); |
| 204 | + } |
| 205 | + return accepted; |
| 206 | +} |
| 207 | + |
| 208 | +// One TLS 1.3 handshake, asking for `first` in the ClientHello and `second` in |
| 209 | +// the one that answers the HelloRetryRequest, returning whether it succeeded. |
| 210 | +async function retrying(first, second) { |
| 211 | + const client = new RawClient(); |
| 212 | + await client.connected; |
| 213 | + client.setServername(first); |
| 214 | + const accepted = await client.handshake(() => client.setServername(second)); |
| 215 | + client.close(); |
| 216 | + return accepted; |
| 217 | +} |
| 218 | + |
| 219 | +server.listen(0, common.mustCall(async () => { |
| 220 | + // Renegotiating must ask for exactly the name the first handshake did, or |
| 221 | + // none if that had none. Changing, dropping or adding a name is refused. |
| 222 | + for (const resume of [false, true]) { |
| 223 | + for (const [first, second, accepted] of [ |
| 224 | + ['agent1.example', 'agent1.example', true], |
| 225 | + [null, null, true], |
| 226 | + ['agent1.example', 'agent3.example', false], |
| 227 | + ['agent1.example', null, false], |
| 228 | + [null, 'agent1.example', false], |
| 229 | + ]) { |
| 230 | + assert.strictEqual(await renegotiating(first, second, { resume }), |
| 231 | + accepted, |
| 232 | + `${resume ? 'resuming then ' : ''}renegotiating ` + |
| 233 | + `from ${first} to ${second}`); |
| 234 | + } |
| 235 | + } |
| 236 | + |
| 237 | + // TLS1.3 HelloRetryRequest can't change SNI either: |
| 238 | + assert.strictEqual(await retrying('agent1.example', 'agent1.example'), true); |
| 239 | + assert.strictEqual(await retrying('agent1.example', 'agent3.example'), false); |
| 240 | + |
| 241 | + server.close(); |
| 242 | +})); |
0 commit comments