archive/node
1
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2025-08-15 13:48:44 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

tls: add --tls-min-v1.2 CLI switch

Browse source 
For 11.x, the default minimum is TLSv1, so it needs a CLI switch to
change the default to the more secure minimum of TLSv1.2.

PR-URL: https://github.com/nodejs/node/pull/26951
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
This commit is contained in:
Sam Roberts 2019-03-28 10:52:41 -07:00 • committed by Beth Griggs
parent 7aeca270f6
commit bf2c283555
No known key found for this signature in database
GPG key ID: D7062848A1AB005C
6 changed files with 34 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
doc/api/cli.md
View file

@ -475,6 +475,14 @@ added: REPLACEME
Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.1'. Use for compatibility Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.1'. Use for compatibility
with old TLS clients or servers. with old TLS clients or servers.
### `--tls-min-v1.2`
<!-- YAML
added: REPLACEME
-->
Set default [`minVersion`][] to `'TLSv1.2'`. Use to disable support for TLSv1
and TLSv1.1 in favour of TLSv1.2, which is more secure.
### `--tls-min-v1.3` ### `--tls-min-v1.3`
<!-- YAML <!-- YAML
added: REPLACEME added: REPLACEME

4
doc/node.1
View file

@ -250,6 +250,10 @@ or servers.
Set default minVersion to 'TLSv1.1'. Use for compatibility with old TLS clients Set default minVersion to 'TLSv1.1'. Use for compatibility with old TLS clients
or servers. or servers.
. .
.It Fl -tls-min-v1.2
Set default minVersion to 'TLSv1.2'. Use to disable support for TLSv1 and
TLSv1.1 in favour of TLSv1.2, which is more secure.
.
.It Fl -tls-min-v1.3 .It Fl -tls-min-v1.3
Set default minVersion to 'TLSv1.3'. Use to disable support for TLSv1.2 in Set default minVersion to 'TLSv1.3'. Use to disable support for TLSv1.2 in
favour of TLSv1.3, which is more secure. favour of TLSv1.3, which is more secure.

2
lib/tls.js
View file

@ -58,6 +58,8 @@ if (getOptionValue('--tls-min-v1.0'))
exports.DEFAULT_MIN_VERSION = 'TLSv1'; exports.DEFAULT_MIN_VERSION = 'TLSv1';
else if (getOptionValue('--tls-min-v1.1')) else if (getOptionValue('--tls-min-v1.1'))
exports.DEFAULT_MIN_VERSION = 'TLSv1.1'; exports.DEFAULT_MIN_VERSION = 'TLSv1.1';
else if (getOptionValue('--tls-min-v1.2'))
exports.DEFAULT_MIN_VERSION = 'TLSv1.2';
else if (getOptionValue('--tls-min-v1.3')) else if (getOptionValue('--tls-min-v1.3'))
exports.DEFAULT_MIN_VERSION = 'TLSv1.3'; exports.DEFAULT_MIN_VERSION = 'TLSv1.3';
else else

4
src/node_options.cc
View file

@ -336,6 +336,10 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
"set default TLS minimum to TLSv1.1 (default: TLSv1)", "set default TLS minimum to TLSv1.1 (default: TLSv1)",
&EnvironmentOptions::tls_min_v1_1, &EnvironmentOptions::tls_min_v1_1,
kAllowedInEnvironment); kAllowedInEnvironment);
AddOption("--tls-min-v1.2",
"set default TLS minimum to TLSv1.2 (default: TLSv1)",
&EnvironmentOptions::tls_min_v1_2,
kAllowedInEnvironment);
AddOption("--tls-min-v1.3", AddOption("--tls-min-v1.3",
"set default TLS minimum to TLSv1.3 (default: TLSv1)", "set default TLS minimum to TLSv1.3 (default: TLSv1)",
&EnvironmentOptions::tls_min_v1_3, &EnvironmentOptions::tls_min_v1_3,

1
src/node_options.h
View file

@ -138,6 +138,7 @@ class EnvironmentOptions : public Options {
bool tls_min_v1_0 = false; bool tls_min_v1_0 = false;
bool tls_min_v1_1 = false; bool tls_min_v1_1 = false;
bool tls_min_v1_2 = false;
bool tls_min_v1_3 = false; bool tls_min_v1_3 = false;
bool tls_max_v1_2 = false; bool tls_max_v1_2 = false;
bool tls_max_v1_3 = false; bool tls_max_v1_3 = false;

15
test/parallel/test-tls-cli-min-version-1.2.js Normal file
View file

@ -0,0 +1,15 @@
// Flags: --tls-min-v1.2
'use strict';
const common = require('../common');
if (!common.hasCrypto) common.skip('missing crypto');
// Check that node `--tls-min-v1.2` is supported.
const assert = require('assert');
const tls = require('tls');
assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.2');
assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.2');
// Check the min-max version protocol versions against these CLI settings.
require('./test-tls-min-max-version.js');