lukechilds/node - node - Gitea: Git with a cup of tea

10747 Commits

131 Branches

446 Tags

325 MiB

Tree: caa16b41d6

Commit Graph

Author SHA1 Message Date

Author	SHA1	Message	Date
Michael Dawson	caa16b41d6	tls: prevent server from using dhe keys < 768 As part of the fix for logjam, node was upgraded to a level of openssl which rejects connections to servers that are using keys smaller than 768 bits. It is still possible, however, to create a server that uses a smaller key size and and older client may be able to connect to it. This PR moves us to a secure by default stance on the server side as well, preventing the creation of a server using a dhe key size less than 768. This can be overridden with the command line option which is also added. It is derived from `9b35be5810` which was landed in later io.js/node versions but makes the limit 1024. This PR uses the smaller limit in order to meet the recomendations for logjam while matching was was done on the client side in openssl to minimize the potential impacton users. The command line option will only be documented in the release notes and will not be added to the tls documentation. The goal is that people who are upgrading are aware and can use the option if they run into issues, but otherwise the option is not visible/used. PR-URL: https://github.com/nodejs/node/pull/3890 Fixes: https://github.com/nodejs/LTS/issues/49 Reviewed-By: Myles Borins <mborins@us.ibm.com> Reviewed-By: James Snell <jasnell@gmail.com> Reviewed-By: Rod Vagg <r@va.gg> Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>	9 years ago
Shigeki Ohtsu	139dbe8bb7	test: remove 512 bits test in test-tls-dhe.js Test of 512 bits key is failed after upgrading openssl-1.0.1o due to its limit of 768 bits key size. Remove it and start from 1024 bits test. Reviewed-By: Michael Dawson <mdawson@devrus.com> PR-URL: https://github.com/joyent/node/pull/25533	10 years ago
Shigeki Ohtsu	0dfedb7127	tls, crypto: add DHE support In case of an invalid DH parameter file, it is sliently discarded. To use auto DH parameter in a server and DHE key length check in a client, we need to wait for the next release of OpenSSL-1.0.2. Reviewed-By: Fedor Indutny <fedor@indutny.com>	11 years ago

Michael Dawson

caa16b41d6

tls: prevent server from using dhe keys < 768

As part of the fix for logjam, node was upgraded to a
level of openssl which rejects connections to servers that
are using keys smaller than 768 bits. It is still possible,
however, to create a server that uses a smaller key size
and and older client may be able to connect to it.

This PR moves us to a secure by default stance on the
server side as well, preventing the creation of a server
using a dhe key size less than 768. This can be overridden
with the command line option which is also added.

It is derived from

9b35be5810

which was landed in later io.js/node versions but makes
the limit 1024.  This PR uses the smaller limit in order
to meet the recomendations for logjam while matching was
was done on the client side in openssl to minimize the
potential impacton users.

The command line option will only be documented in the
release notes and will not be added to the tls
documentation.  The goal is that people who are
upgrading are aware and can use the option if they
run into issues, but otherwise the option is not
visible/used.

PR-URL: https://github.com/nodejs/node/pull/3890
Fixes: https://github.com/nodejs/LTS/issues/49
Reviewed-By: Myles Borins <mborins@us.ibm.com>
Reviewed-By: James Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>

9 years ago

Shigeki Ohtsu

139dbe8bb7

test: remove 512 bits test in test-tls-dhe.js

Test of 512 bits key is failed after upgrading openssl-1.0.1o due to
its limit of 768 bits key size. Remove it and start from 1024 bits
test.

Reviewed-By: Michael Dawson <mdawson@devrus.com>
PR-URL: https://github.com/joyent/node/pull/25533

10 years ago

Shigeki Ohtsu

0dfedb7127

tls, crypto: add DHE support

In case of an invalid DH parameter file, it is sliently discarded. To
use auto DH parameter in a server and DHE key length check in a
client, we need to wait for the next release of OpenSSL-1.0.2.

Reviewed-By: Fedor Indutny <fedor@indutny.com>

11 years ago

3 Commits (caa16b41d6820d86eeb3d272daa3cef25fa3ed9f)