Skip to content

crypto: setting --tls-max-v1.2 and --tls-cipher-list seems to ignore --tls-min-* setting #43406

Closed
#44086
Closed
crypto: setting --tls-max-v1.2 and --tls-cipher-list seems to ignore --tls-min-* setting#43406
#44086
Labels
cryptoIssues and PRs related to the crypto subsystem.

Description

@AdamMajer
AdamMajer
opened on Jun 13, 2022

Version

18.2.0, master

Platform

Linux localhost 5.17.7-1-default #1 SMP PREEMPT Thu May 12 12:38:04 UTC 2022 (c9a5fa1) x86_64 x86_64 x86_64 GNU/Linux

Subsystem

No response

What steps will reproduce the bug?

./node --tls-max-v1.2 --tls-min-v1.2 --tls-cipher-list='TLS_RSA_WITH_AES_256_CBC_SHA' -e "https.get('https://google.com/', (res) => {console.log('statusCode:', res.statusCode, res.client.getCipher()); }).on('error', (e) => console.error(e));"

How often does it reproduce? Is there a required condition?

No response

What is the expected behavior?

TLSv1.2 connection or failure thereof

What do you see instead?

statusCode: 301 {
  name: 'AES256-SHA',
  standardName: 'TLS_RSA_WITH_AES_256_CBC_SHA',
  version: 'SSLv3'
}

Additional information

No response

Activity

  1. VoltrexKeyva
    added
    cryptoIssues and PRs related to the crypto subsystem.
    on Jun 13, 2022

  2. bnoordhuis commented on Jun 14, 2022

    @bnoordhuis
    bnoordhuis
    on Jun 14, 2022
    Member

    TLS_RSA_WITH_AES_256_CBC_SHA is still around in TLSv1.2: https://ciphersuite.info/cs/TLS_RSA_WITH_AES_256_CBC_SHA/

    Is your report about the version: 'SSLv3' line in the output? OpenSSL's SSL_CIPHER_get_version() reports the cipher's minimum SSL/TLS protocol version, not the protocol version of the current session.

  3. AdamMajer commented on Jun 14, 2022

    @AdamMajer
    AdamMajer
    on Jun 14, 2022
    ContributorAuthor

    Yes, indeed, I was indeed confused about the SSLv3 in the getCiphers() line. I've found getProtocol() and life makes sense again. Thanks for the clarification.

  4. AdamMajer
    closed this as completedon Jun 14, 2022

  5. bnoordhuis commented on Jun 14, 2022

    @bnoordhuis
    bnoordhuis
    on Jun 14, 2022
    Member

    If you're up for it, I think a documentation update to tlsSocket.getCipher() can help clarify the difference between the cipher and the session protocol version.

    It is mentioned but the example uses a TLSv1.2-only cipher, making it an easy-to-miss nuance.

  6. nodejs-github-bot
    added a commit that references this issue on Aug 3, 2022

    doc: clarify tls.tlsSocket.getCipher().version

    dd9cd81
  7. danielleadams
    added a commit that references this issue on Aug 16, 2022

    doc: clarify tls.tlsSocket.getCipher().version

    29bbabd
  8. ruyadorno
    added a commit that references this issue on Aug 23, 2022

    doc: clarify tls.tlsSocket.getCipher().version

    46f8fb8
  9. targos
    added a commit that references this issue on Sep 5, 2022

    doc: clarify tls.tlsSocket.getCipher().version

    e367497
  10. guangwong
    added 2 commits that reference this issue on Jan 3, 2023

    doc: clarify tls.tlsSocket.getCipher().version

    04998d8

    doc: clarify tls.tlsSocket.getCipher().version

    88a0b46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    cryptoIssues and PRs related to the crypto subsystem.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions