archive/node
1
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2025-08-15 13:48:44 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

tls: add --tls-min-v1.2 CLI switch

Browse source 
For 11.x, the default minimum is TLSv1, so it needs a CLI switch to
change the default to the more secure minimum of TLSv1.2.

PR-URL: https://github.com/nodejs/node/pull/26951
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
This commit is contained in:
Sam Roberts 2019-03-28 10:52:41 -07:00 • committed by Beth Griggs
parent 7aeca270f6
commit bf2c283555
No known key found for this signature in database
GPG key ID: D7062848A1AB005C
6 changed files with 34 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
doc/api/cli.md
View file

@ -475,6 +475,14 @@ added: REPLACEME
Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.1'. Use for compatibility
with old TLS clients or servers.
### `--tls-min-v1.2`
<!-- YAML
added: REPLACEME
-->
Set default [`minVersion`][] to `'TLSv1.2'`. Use to disable support for TLSv1
and TLSv1.1 in favour of TLSv1.2, which is more secure.
### `--tls-min-v1.3`
<!-- YAML
added: REPLACEME

4
doc/node.1
View file

@ -250,6 +250,10 @@ or servers.
Set default minVersion to 'TLSv1.1'. Use for compatibility with old TLS clients
or servers.
.
.It Fl -tls-min-v1.2
Set default minVersion to 'TLSv1.2'. Use to disable support for TLSv1 and
TLSv1.1 in favour of TLSv1.2, which is more secure.
.
.It Fl -tls-min-v1.3
Set default minVersion to 'TLSv1.3'. Use to disable support for TLSv1.2 in
favour of TLSv1.3, which is more secure.

2
lib/tls.js
View file

@ -58,6 +58,8 @@ if (getOptionValue('--tls-min-v1.0'))
exports.DEFAULT_MIN_VERSION = 'TLSv1';
else if (getOptionValue('--tls-min-v1.1'))
exports.DEFAULT_MIN_VERSION = 'TLSv1.1';
else if (getOptionValue('--tls-min-v1.2'))
exports.DEFAULT_MIN_VERSION = 'TLSv1.2';
else if (getOptionValue('--tls-min-v1.3'))
exports.DEFAULT_MIN_VERSION = 'TLSv1.3';
else

4
src/node_options.cc
View file

@ -336,6 +336,10 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
"set default TLS minimum to TLSv1.1 (default: TLSv1)",
&EnvironmentOptions::tls_min_v1_1,
kAllowedInEnvironment);
AddOption("--tls-min-v1.2",
"set default TLS minimum to TLSv1.2 (default: TLSv1)",
&EnvironmentOptions::tls_min_v1_2,
kAllowedInEnvironment);
AddOption("--tls-min-v1.3",
"set default TLS minimum to TLSv1.3 (default: TLSv1)",
&EnvironmentOptions::tls_min_v1_3,

1
src/node_options.h
View file

@ -138,6 +138,7 @@ class EnvironmentOptions : public Options {
bool tls_min_v1_0 = false;
bool tls_min_v1_1 = false;
bool tls_min_v1_2 = false;
bool tls_min_v1_3 = false;
bool tls_max_v1_2 = false;
bool tls_max_v1_3 = false;

15
test/parallel/test-tls-cli-min-version-1.2.js Normal file
View file

@ -0,0 +1,15 @@
// Flags: --tls-min-v1.2
'use strict';
const common = require('../common');
if (!common.hasCrypto) common.skip('missing crypto');
// Check that node `--tls-min-v1.2` is supported.
const assert = require('assert');
const tls = require('tls');
assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.2');
assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.2');
// Check the min-max version protocol versions against these CLI settings.
require('./test-tls-min-max-version.js');