From e340b8f1ffed92067e945d89fdb225a00a52f830 Mon Sep 17 00:00:00 2001 From: Sam Roberts Date: Wed, 28 Nov 2018 14:11:18 -0800 Subject: [PATCH] tls: re-define max supported version as 1.2 Several secureProtocol strings allow any supported TLS version as the maximum, but our maximum supported protocol version is TLSv1.2 even if someone configures a build against an OpenSSL that supports TLSv1.3. Fixes: https://github.com/nodejs/node/issues/24658 PR-URL: https://github.com/nodejs/node/pull/25024 Reviewed-By: Richard Lau Reviewed-By: Ben Noordhuis Reviewed-By: Daniel Bevenius Reviewed-By: Colin Ihrig --- src/node_crypto.cc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/node_crypto.cc b/src/node_crypto.cc index b6c3a715982bdc..42fe00b1d0458b 100644 --- a/src/node_crypto.cc +++ b/src/node_crypto.cc @@ -501,6 +501,12 @@ void SecureContext::Init(const FunctionCallbackInfo& args) { SSL_SESS_CACHE_NO_AUTO_CLEAR); SSL_CTX_set_min_proto_version(sc->ctx_.get(), min_version); + + if (max_version == 0) { + // Selecting some secureProtocol methods allows the TLS version to be "any + // supported", but we don't support TLSv1.3, even if OpenSSL does. + max_version = TLS1_2_VERSION; + } SSL_CTX_set_max_proto_version(sc->ctx_.get(), max_version); // OpenSSL 1.1.0 changed the ticket key size, but the OpenSSL 1.0.x size was // exposed in the public API. To retain compatibility, install a callback