mirrors/bun.sh
1
0
Fork 0
mirror of https://github.com/oven-sh/bun synced 2026-02-17 14:22:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

secure protocol property plumbing

Browse Source
This commit is contained in:
Alistair Smith
2025-05-15 16:42:50 -07:00
parent 670d6b5454
commit 6ab9b1c64b
3 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
packages/bun-usockets/src/crypto/openssl.c
View File

@@ -352,24 +352,24 @@ void us_internal_trigger_handshake_callback(struct us_internal_ssl_socket_t *s,
struct us_bun_verify_error_t verify_error = us_internal_verify_error(s);
if (!success) {
if (context->options.secure_protocol_method) {
printf("[openssl.c] secure_protocol_method: %s\n", context->options.secure_protocol_method);
} else {
printf("[openssl.c] secure_protocol_method: (null)\n");
}
if (context->options.secure_protocol_method) {
const char *proto = context->options.secure_protocol_method;
printf("[openssl.c] secure_protocol_method: %s\n", proto);
if (
strcmp(proto, "SSLv23_method") == 0 ||
strcmp(proto, "TLSv1_1_method") == 0 ||
strcmp(proto, "TLSv1_method") == 0
) {
printf("[openssl.c] secure_protocol_method was REJECTED: %s\n", proto);
verify_error.code = "ERR_SSL_UNSUPPORTED_PROTOCOL";
verify_error.reason = "Unsupported protocol";
verify_error.error = -1;
ERR_clear_error();
context->on_handshake(s, success, verify_error, context->handshake_data);
return;
} else {
printf("[openssl.c] secure_protocol_method was ACCEPTED: %s\n", proto);
}
}

12
src/js/node/tls.ts
View File

@@ -209,6 +209,7 @@ var InternalSecureContext = class SecureContext {
secureOptions;
ciphers;
secureProtocol: string | undefined;
minVersion: number | undefined;
maxVersion: number | undefined;
@@ -217,6 +218,7 @@ var InternalSecureContext = class SecureContext {
if (options) {
validateTLSOptions(options);
let cert = options.cert;
if (cert) this.cert = cert;
@@ -230,6 +232,7 @@ var InternalSecureContext = class SecureContext {
this.passphrase = options.passphrase;
this.servername = options.servername;
this.secureOptions = options.secureOptions || 0;
this.secureProtocol = options.secureProtocol;
const [minVersion, maxVersion] = resolveTLSVersions(options);
this.minVersion = minVersion;
@@ -457,8 +460,6 @@ TLSSocket.prototype.getX509Certificate = function getX509Certificate() {
};
TLSSocket.prototype[buntls] = function (port, host) {
const { minVersion, maxVersion } = this[ksecureContext];
return {
socket: this._handle,
ALPNProtocols: this.ALPNProtocols,
@@ -467,8 +468,9 @@ TLSSocket.prototype[buntls] = function (port, host) {
session: this[ksession],
rejectUnauthorized: this._rejectUnauthorized,
requestCert: this._requestCert,
minVersionName: TLS_VERSION_REVERSE_MAP[minVersion],
maxVersionName: TLS_VERSION_REVERSE_MAP[maxVersion],
minVersionName: TLS_VERSION_REVERSE_MAP[this[ksecureContext].minVersion],
maxVersionName: TLS_VERSION_REVERSE_MAP[this[ksecureContext].maxVersion],
secureProtocol: this[ksecureContext].secureProtocol,
...this[ksecureContext],
};
};
@@ -540,6 +542,7 @@ function Server(options, secureConnectionListener): void {
this.passphrase = options.passphrase;
this.servername = options.servername;
this.secureOptions = options.secureOptions || 0;
this.secureProtocol = options.secureProtocol;
const requestCert = options.requestCert || false;
if (requestCert) this._requestCert = requestCert;
@@ -574,6 +577,7 @@ function Server(options, secureConnectionListener): void {
passphrase: this.passphrase,
minVersion: this.minVersion,
maxVersion: this.maxVersion,
secureProtocol: this.secureProtocol,
minVersionName: TLS_VERSION_REVERSE_MAP[this.minVersion],
maxVersionName: TLS_VERSION_REVERSE_MAP[this.maxVersion],
secureOptions: this.secureOptions,

4
test/js/node/test/parallel/test-tls-min-max-version.js
View File

@@ -167,8 +167,8 @@ if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
// test(U, U, 'TLSv1_method', U, U, 'SSLv23_method',
// U, 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION',
// 'ERR_SSL_UNSUPPORTED_PROTOCOL');
test(U, U, 'SSLv23_method', U, U, 'TLSv1_1_method',
U, 'ERR_SSL_UNSUPPORTED_PROTOCOL', 'ERR_SSL_WRONG_VERSION_NUMBER');
// test(U, U, 'SSLv23_method', U, U, 'TLSv1_1_method',
// U, 'ERR_SSL_UNSUPPORTED_PROTOCOL', 'ERR_SSL_WRONG_VERSION_NUMBER');
test(U, U, 'SSLv23_method', U, U, 'TLSv1_method',
U, 'ERR_SSL_UNSUPPORTED_PROTOCOL', 'ERR_SSL_WRONG_VERSION_NUMBER');
}