Skip to content

Commit bd74d90

Browse files
author
Julien Gilli
committed
tls,crypto: update default cipher list version numbers
1 parent 9783a82 commit bd74d90

8 files changed

Lines changed: 55 additions & 55 deletions

File tree

‎doc/api/tls.markdown‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -135,41 +135,41 @@ absolutely necessary.
135135

136136
It is possible for the built-in default cipher suite to change from one release
137137
of Node.js to another. For instance, v0.10.39 uses a different default than
138-
v0.10.38. Such changes can cause issues with applications written to assume
138+
v0.10.40. Such changes can cause issues with applications written to assume
139139
certain specific defaults. To help buffer applications against such changes,
140140
the `--enable-legacy-cipher-list` command line switch or `NODE_LEGACY_CIPHER_LIST`
141141
environment variable can be set to specify a specific preset default:
142142

143-
# Use the v0.10.38 defaults
144-
node --enable-legacy-cipher-list=v0.10.38
143+
# Use the v0.10.40 defaults
144+
node --enable-legacy-cipher-list=v0.10.40
145145
// or
146-
NODE_LEGACY_CIPHER_LIST=v0.10.38
146+
NODE_LEGACY_CIPHER_LIST=v0.10.40
147147

148148
Currently, the values supported for the `enable-legacy-cipher-list` switch and
149149
`NODE_LEGACY_CIPHER_LIST` environment variable include:
150150

151-
v0.10.38 - To enable the default cipher suite used in v0.10.38
151+
v0.10.40 - To enable the default cipher suite used in v0.10.40
152152

153153
ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH
154154

155155
These legacy cipher suites are also made available for use via the
156156
`getLegacyCiphers()` method:
157157

158158
var tls = require('tls');
159-
console.log(tls.getLegacyCiphers('v0.10.38'));
159+
console.log(tls.getLegacyCiphers('v0.10.40'));
160160

161161
CAUTION: Changes to the default cipher suite are typically made in order to
162162
strengthen the default security for applications running within Node.js.
163163
Reverting back to the defaults used by older releases can weaken the security
164164
of your applications. The legacy cipher suites should only be used if absolutely
165165
necessary.
166166

167-
NOTE: Due to an error in Node.js v0.10.38, the default cipher list only applied
167+
NOTE: Due to an error in Node.js v0.10.40, the default cipher list only applied
168168
to servers using TLS. The default cipher list would _not_ be used by clients.
169169
This behavior has been changed in v0.10.39 and the default cipher list is now
170170
used by both the server and client when using TLS. However, when using
171-
`--enable-legacy-cipher-list=v0.10.38`, Node.js is reverted back to the
172-
v0.10.38 behavior of only using the default cipher list on the server.
171+
`--enable-legacy-cipher-list=v0.10.40`, Node.js is reverted back to the
172+
v0.10.40 behavior of only using the default cipher list on the server.
173173

174174
### Cipher List Precedence
175175

@@ -184,11 +184,11 @@ will override the environment variables. If both happen to be specified, the
184184
right-most (second one specified) will take precedence. For instance, in the
185185
example:
186186

187-
node --cipher-list=ABC --enable-legacy-cipher-list=v0.10.38
187+
node --cipher-list=ABC --enable-legacy-cipher-list=v0.10.40
188188

189-
The v0.10.38 default cipher list will be used.
189+
The v0.10.40 default cipher list will be used.
190190

191-
node --enable-legacy-cipher-list=v0.10.38 --cipher-list=ABC
191+
node --enable-legacy-cipher-list=v0.10.40 --cipher-list=ABC
192192

193193
The custom cipher list will be used.
194194

@@ -206,7 +206,7 @@ Example:
206206

207207
Returns a default cipher list used in a previous version of Node.js. The
208208
version parameter must be a string whose value identifies previous Node.js
209-
release version. The only value currently supported is `v0.10.38`.
209+
release version. The only value currently supported is `v0.10.40`.
210210

211211
A TypeError will be thrown if: (a) the `version` is any type other than a
212212
string, (b) the `version` parameter is not specified, or (c) additional

‎lib/crypto.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -135,9 +135,9 @@ exports.createCredentials = function(options, context) {
135135

136136
if (options.ciphers) {
137137
c.context.setCiphers(options.ciphers);
138-
} else if (!(process._usingV1038Ciphers() && options.ciphers === undefined)) {
138+
} else if (!(process._usingV1040Ciphers() && options.ciphers === undefined)) {
139139
// Set the ciphers to the default ciphers list unless
140-
// --enable-legacy-cipher-list=v0.10.38 was passed on the command line and
140+
// --enable-legacy-cipher-list=v0.10.40 was passed on the command line and
141141
// no ciphers value was passed explicitly. In that case, we want to
142142
// preserve the previous buggy behavior that existed in v0.10.x until
143143
// v0.10.39, otherwise, a lot of client code might be broken. Server

‎lib/tls.js‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1338,14 +1338,14 @@ exports.connect = function(/* [port, host], options, cb */) {
13381338
var defaults = {
13391339
rejectUnauthorized: '0' !== process.env.NODE_TLS_REJECT_UNAUTHORIZED
13401340
};
1341-
if (!process._usingV1038Ciphers()) {
1341+
if (!process._usingV1040Ciphers()) {
13421342
// only set the default ciphers if we are _not_ using the
1343-
// v0.10.38 legacy cipher list. Node v0.10.38 had a bug
1343+
// v0.10.40 legacy cipher list. Node v0.10.40 had a bug
13441344
// that failed to set the default ciphers on the default
13451345
// options. This has been fixed in v0.10.39 and above.
13461346
// However, when the user explicitly tells node to revert
1347-
// back to using the v0.10.38 cipher list, node should
1348-
// revert back to the original v0.10.38 behavior.
1347+
// back to using the v0.10.40 cipher list, node should
1348+
// revert back to the original v0.10.40 behavior.
13491349
defaults.ciphers = DEFAULT_CIPHERS;
13501350
}
13511351
options = util._extend(defaults, options || {});

‎src/node.cc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2567,7 +2567,7 @@ static void PrintHelp() {
25672567
" --enable-ssl2 enable ssl2\n"
25682568
" --enable-ssl3 enable ssl3\n"
25692569
" --cipher-list=val specify the default TLS cipher list\n"
2570-
" --enable-legacy-cipher-list=v0.10.38 \n"
2570+
" --enable-legacy-cipher-list=v0.10.40 \n"
25712571
"\n"
25722572
"Environment variables:\n"
25732573
#ifdef _WIN32
@@ -2580,7 +2580,7 @@ static void PrintHelp() {
25802580
" global contexts.\n"
25812581
"NODE_DISABLE_COLORS Set to 1 to disable colors in the REPL\n"
25822582
"NODE_CIPHER_LIST Override the default TLS cipher list\n"
2583-
"NODE_LEGACY_CIPHER_LIST=v0.10.38\n"
2583+
"NODE_LEGACY_CIPHER_LIST=v0.10.40\n"
25842584
"\n"
25852585
"Documentation can be found at http://nodejs.org/\n");
25862586
}

‎src/node.js‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -171,17 +171,17 @@
171171
};
172172

173173
startup.setupLegacyCiphers = function setupLegacyCiphers() {
174-
process._usingV1038Ciphers = function _usingV1038Ciphers() {
174+
process._usingV1040Ciphers = function _usingV1040Ciphers() {
175175
// Returns true if the --enable-legacy-cipher-list command line
176176
// switch, or the NODE_LEGACY_CIPHER_LIST environment variable
177-
// are set to v0.10.38 and the DEFAULT_CIPHERS equal the v0.10.38
177+
// are set to v0.10.40 and the DEFAULT_CIPHERS equal the v0.10.40
178178
// list.
179179
var crypto = process.binding('crypto');
180180

181181
var argv = process.execArgv;
182-
if ((argv.indexOf('--enable-legacy-cipher-list=v0.10.38') > -1 ||
183-
process.env.NODE_LEGACY_CIPHER_LIST === 'v0.10.38') &&
184-
crypto.DEFAULT_CIPHER_LIST === crypto.getLegacyCiphers('v0.10.38')) {
182+
if ((argv.indexOf('--enable-legacy-cipher-list=v0.10.40') > -1 ||
183+
process.env.NODE_LEGACY_CIPHER_LIST === 'v0.10.40') &&
184+
crypto.DEFAULT_CIPHER_LIST === crypto.getLegacyCiphers('v0.10.40')) {
185185
return true;
186186
}
187187

‎src/node_crypto.cc‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ static const int X509_NAME_FLAGS = ASN1_STRFLGS_ESC_CTRL
6262
| XN_FLAG_SEP_MULTILINE
6363
| XN_FLAG_FN_SN;
6464

65-
#define DEFAULT_CIPHER_LIST_V10_38 "ECDHE-RSA-AES128-SHA256:" \
65+
#define DEFAULT_CIPHER_LIST_V10_40 "ECDHE-RSA-AES128-SHA256:" \
6666
"AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH"
6767

6868
#define DEFAULT_CIPHER_LIST_HEAD "ECDHE-RSA-AES128-SHA256:" \
@@ -4207,8 +4207,8 @@ const char* LegacyCipherList(const char * ver) {
42074207
if (ver == NULL) {
42084208
return NULL;
42094209
}
4210-
if (strncmp(ver, "v0.10.38", 8) == 0) {
4211-
return DEFAULT_CIPHER_LIST_V10_38;
4210+
if (strncmp(ver, "v0.10.40", 8) == 0) {
4211+
return DEFAULT_CIPHER_LIST_V10_40;
42124212
} else {
42134213
return NULL;
42144214
}

‎test/external/ssl-options/test.js‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ var RC4_MD5_CIPHER = 'RC4-MD5';
2626
//
2727
// This specific cipher is used to test that it can be used with current
2828
// versions of Node.js *only* when both ends explicitly specify RC4-SHA
29-
// as the cipher they want to use, or if --enable-legacy-cipher-list=v0.10.38
29+
// as the cipher they want to use, or if --enable-legacy-cipher-list=v0.10.40
3030
// is passed at least to the client or the server.
3131
//
3232
// Note also that RC4-SHA is a SSLv3 cipher, not a SSLv2 cipher contrary to
@@ -37,7 +37,7 @@ var CMD_LINE_OPTIONS = [
3737
null,
3838
"--enable-ssl2",
3939
"--enable-ssl3",
40-
"--enable-legacy-cipher-list=v0.10.38"
40+
"--enable-legacy-cipher-list=v0.10.40"
4141
];
4242

4343
var SERVER_SSL_PROTOCOLS = [
@@ -188,13 +188,13 @@ function testSSLv2Setups(serverSetup, clientSetup) {
188188

189189
// It is also the case if the server passes explicitly RC4-MD%
190190
// but the client doesn't pass any cipher and passes
191-
// --enable-legacy-cipher-list=v0.10.38 on the command line. This basically
191+
// --enable-legacy-cipher-list=v0.10.40 on the command line. This basically
192192
// keeps the buggy be behavior of clients not using the default ciphers
193193
// list when not explicitly passing any cipher, and as a result
194194
// allowing RC4 and MD5 to be used.
195195
if (serverSetup.ciphers === RC4_MD5_CIPHER &&
196196
clientSetup.ciphers === undefined &&
197-
clientSetup.cmdLine === '--enable-legacy-cipher-list=v0.10.38')
197+
clientSetup.cmdLine === '--enable-legacy-cipher-list=v0.10.40')
198198
return true;
199199

200200
// In all other cases, when using SSLv2 on both sides,
@@ -222,7 +222,7 @@ function testRC4LegacyCiphers(serverSetup, clientSetup) {
222222
// To be able to use a RC4 cipher suite, either both ends specify it (like
223223
// for the test using RC4-MD5), or one end pass it explicitly and the other
224224
// uses the default ciphers list while passing the
225-
// --enable-legacy-cipher-list=v0.10.38 command line option
225+
// --enable-legacy-cipher-list=v0.10.40 command line option
226226
// We're using RC4-SHA as our test cipher suite, because SHA is allowed by
227227
// default and not RC4, so we know that we're only testing disabling/enabling
228228
// RC4.
@@ -236,12 +236,12 @@ function testRC4LegacyCiphers(serverSetup, clientSetup) {
236236

237237
if (serverSetup.ciphers === RC4_SHA_CIPHER &&
238238
usesDefaultCiphers(clientSetup) &&
239-
clientSetup.cmdLine === '--enable-legacy-cipher-list=v0.10.38')
239+
clientSetup.cmdLine === '--enable-legacy-cipher-list=v0.10.40')
240240
return true;
241241

242242
if (clientSetup.ciphers === RC4_SHA_CIPHER &&
243243
usesDefaultCiphers(serverSetup) &&
244-
serverSetup.cmdLine === '--enable-legacy-cipher-list=v0.10.38')
244+
serverSetup.cmdLine === '--enable-legacy-cipher-list=v0.10.40')
245245
return true;
246246

247247
// Otherwise, if only one end passes a RC4 cipher suite explicitly,

‎test/simple/test-tls-cipher-list.js‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ var crypto = process.binding('crypto');
2626
var common = require('../common');
2727
var fs = require('fs');
2828

29-
var V1038Ciphers = tls.getLegacyCiphers('v0.10.38');
29+
var V1038Ciphers = tls.getLegacyCiphers('v0.10.40');
3030

3131
function doTest(checklist, additional_args, env) {
3232
var options;
@@ -54,53 +54,53 @@ function doTestPrecedence() {
5454
// test that --enable-legacy-cipher-list takes precedence
5555
// over NODE_CIPHER_LIST
5656
doTest(V1038Ciphers,
57-
['--enable-legacy-cipher-list=v0.10.38'],
57+
['--enable-legacy-cipher-list=v0.10.40'],
5858
{'NODE_CIPHER_LIST': 'XYZ'});
5959

6060
// test that --cipher-list takes precedence over NODE_LEGACY_CIPHER_LIST
6161
doTest('ABC',
6262
['--cipher-list=ABC'],
63-
{'NODE_LEGACY_CIPHER_LIST': 'v0.10.38'});
63+
{'NODE_LEGACY_CIPHER_LIST': 'v0.10.40'});
6464

6565
// test that --enable-legacy-cipher-list takes precence over both envars
6666
// note: in this release, there's only one legal value for the legacy
6767
// switch so this test is largely a non-op. When multiple values
6868
// are supported, this test should be changed to test that the
6969
// command line switch actually does override
7070
doTest(V1038Ciphers,
71-
['--enable-legacy-cipher-list=v0.10.38'],
71+
['--enable-legacy-cipher-list=v0.10.40'],
7272
{
73-
'NODE_LEGACY_CIPHER_LIST': 'v0.10.38',
73+
'NODE_LEGACY_CIPHER_LIST': 'v0.10.40',
7474
'NODE_CIPHER_LIST': 'XYZ'
7575
});
7676

7777
// test the right-most command line option takes precedence
7878
doTest(V1038Ciphers,
7979
[
8080
'--cipher-list=XYZ',
81-
'--enable-legacy-cipher-list=v0.10.38'
81+
'--enable-legacy-cipher-list=v0.10.40'
8282
]);
8383

8484
// test the right-most command line option takes precedence
8585
doTest('XYZ',
8686
[
87-
'--enable-legacy-cipher-list=v0.10.38',
87+
'--enable-legacy-cipher-list=v0.10.40',
8888
'--cipher-list=XYZ'
8989
]);
9090

9191
// test the right-most command line option takes precedence
9292
doTest('XYZ',
9393
[
9494
'--cipher-list=ABC',
95-
'--enable-legacy-cipher-list=v0.10.38',
95+
'--enable-legacy-cipher-list=v0.10.40',
9696
'--cipher-list=XYZ'
9797
]);
9898

9999
// test that NODE_LEGACY_CIPHER_LIST takes precedence over
100100
// NODE_CIPHER_LIST
101101
doTest(V1038Ciphers, [],
102102
{
103-
'NODE_LEGACY_CIPHER_LIST': 'v0.10.38',
103+
'NODE_LEGACY_CIPHER_LIST': 'v0.10.40',
104104
'NODE_CIPHER_LIST': 'ABC'
105105
});
106106
}
@@ -115,7 +115,7 @@ doTest('ABC', [], {'NODE_CIPHER_LIST':'ABC'});
115115
doTest('ABC', ['--cipher-list=ABC']);
116116

117117
// Test the --enable-legacy-cipher-list and NODE_LEGACY_CIPHER_LIST envar
118-
['v0.10.38'].forEach(function(arg) {
118+
['v0.10.40'].forEach(function(arg) {
119119
var checklist = tls.getLegacyCiphers(arg);
120120
// command line switch
121121
doTest(checklist, ['--enable-legacy-cipher-list=' + arg]);
@@ -136,11 +136,11 @@ assert.throws(function() {tls.getLegacyCiphers(1);}, TypeError);
136136
// too many parameters
137137
assert.throws(function() {tls.getLegacyCiphers('abc', 'extra');}, TypeError);
138138
// ah, just right
139-
assert.doesNotThrow(function() {tls.getLegacyCiphers('v0.10.38');});
139+
assert.doesNotThrow(function() {tls.getLegacyCiphers('v0.10.40');});
140140

141-
// Test to ensure default ciphers are not set when v0.10.38 legacy cipher
141+
// Test to ensure default ciphers are not set when v0.10.40 legacy cipher
142142
// switch is used. This is a bit involved... we need to first set up the
143-
// TLS server, then spawn a second node instance using the v0.10.38 cipher,
143+
// TLS server, then spawn a second node instance using the v0.10.40 cipher,
144144
// then connect and check to make sure the options are correct. Since there
145145
// is no direct way of testing it, an alternate createCredentials shim is
146146
// created that intercepts the call to createCredentials and checks the
@@ -159,7 +159,7 @@ var fail_if_default_ciphers_set = (
159159
require('crypto').createCredentials = function(options) {
160160
used_monkey_patch = true;
161161
// since node was started with the --enable-legacy-cipher-list
162-
// switch equal to v0.10.38, the options.ciphers should be
162+
// switch equal to v0.10.40, the options.ciphers should be
163163
// undefined. If it's not undefined, we have a problem and
164164
// the test fails
165165
if (options.ciphers !== undefined) {
@@ -253,19 +253,19 @@ var server = tls.Server(options, function(socket) {
253253
server.listen(common.PORT, function() {
254254
// checks to make sure the default ciphers are *not* set
255255
// because the --enable-legacy-cipher-list switch is set to
256-
// v0.10.38
256+
// v0.10.40
257257
doDefaultCipherTest(fail_if_default_ciphers_set,
258-
['--enable-legacy-cipher-list=v0.10.38']);
258+
['--enable-legacy-cipher-list=v0.10.40']);
259259

260260
// checks to make sure the default ciphers are *not* set
261-
// because the NODE_LEGACY_CIPHER_LIST envar is set to v0.10.38
261+
// because the NODE_LEGACY_CIPHER_LIST envar is set to v0.10.40
262262
doDefaultCipherTest(fail_if_default_ciphers_set,
263-
[], {'NODE_LEGACY_CIPHER_LIST': 'v0.10.38'});
263+
[], {'NODE_LEGACY_CIPHER_LIST': 'v0.10.40'});
264264

265265
// this variant checks to ensure that the default cipher list IS set
266266
doDefaultCipherTest(fail_if_default_ciphers_not_set, [], {});
267267

268-
// test that setting the cipher list explicitly to the v0.10.38
268+
// test that setting the cipher list explicitly to the v0.10.40
269269
// string without using the legacy cipher switch causes the
270270
// default ciphers to be set.
271271
doDefaultCipherTest(fail_if_default_ciphers_not_set,

0 commit comments

Comments
 (0)