Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: enable TLS renegotiation in node #25040

Merged
merged 3 commits into from
Aug 20, 2020
Merged

fix: enable TLS renegotiation in node #25040

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
14103c5
fix: enable TLS renegotiation in node
nornagon Aug 18, 2020
1c7ec7f
Update .patches
nornagon Aug 19, 2020
55f14ca
update patches
Aug 19, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions patches/node/.patches
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,3 +46,4 @@ lib_src_switch_buffer_kmaxlength_to_size_t.patch
update_tests_after_increasing_typed_array_size.patch
darwin_work_around_clock_jumping_back_in_time.patch
lib_use_non-symbols_in_isurlinstance_check.patch
fix_enable_tls_renegotiation.patch
27 changes: 27 additions & 0 deletions patches/node/fix_enable_tls_renegotiation.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Jeremy Rose <nornagon@nornagon.net>
Date: Tue, 18 Aug 2020 09:51:46 -0700
Subject: fix: enable TLS renegotiation

This configures BoringSSL to behave more similarly to OpenSSL.
See https://github.com/electron/electron/issues/18380.

This should be upstreamed.

diff --git a/src/tls_wrap.cc b/src/tls_wrap.cc
index 36877424216ed458eeb7a0796703afb667b89f7c..63546540163abe08eb8c701dda9272c135fb36c0 100644
--- a/src/tls_wrap.cc
+++ b/src/tls_wrap.cc
@@ -129,6 +129,12 @@ void TLSWrap::InitSSL() {
// - https://wiki.openssl.org/index.php/TLS1.3#Non-application_data_records
SSL_set_mode(ssl_.get(), SSL_MODE_AUTO_RETRY);

+#ifdef OPENSSL_IS_BORINGSSL
+ // OpenSSL allows renegotiation by default, but BoringSSL disables it.
+ // Configure BoringSSL to match OpenSSL's behavior.
+ SSL_set_renegotiate_mode(ssl_.get(), ssl_renegotiate_freely);
+#endif
+
SSL_set_app_data(ssl_.get(), this);
// Using InfoCallback isn't how we are supposed to check handshake progress:
// https://github.com/openssl/openssl/issues/7199#issuecomment-420915993