tls: allow TLSSocket construction with a list of ALPNProtocols #16655

qubyte · 2017-10-31T23:06:47Z

Brings the ALPNProtocols option of TLSSocket into line with the
documentation. i.e. a list of strings for protocols may be used, and
not only a buffer.

Fixes: #16643

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
commit message follows commit guidelines

Affected core subsystem(s)

tls

qubyte · 2017-10-31T23:10:52Z

I have some doubt over the tls.convertALPNProtocols method. For example, if I feed it:

var out = {};
tls.convertALPNProtocols(['h2', 'http/1.1'], out);

I expect out.ALPNProtocols to be a buffer of 0x02h20x08http/1.1. What I get instead is a buffer of \u0002h2\bhttp/1.1. Can someone with familiarity shed some light on the discrepancy?

qubyte · 2017-10-31T23:19:11Z

Ignore me. I understand now.

bnoordhuis · 2017-11-01T07:15:29Z

lib/_tls_wrap.js

+  if (this._tlsOptions.NPNProtocols)
+    tls.convertNPNProtocols(this._tlsOptions.NPNProtocols, this._tlsOptions);
+  if (this._tlsOptions.ALPNProtocols)
+    tls.convertALPNProtocols(this._tlsOptions.ALPNProtocols, this._tlsOptions);


You should be able to remove the calls from downstream functions now.

As well, can you make it so (and add a test to that effect) that the user's option object isn't modified? Thanks.

Yup, that had been bothering me too.

bnoordhuis · 2017-11-01T07:19:14Z

test/internet/test-tls-socket-constructor-alpn-npn-options-parsing.js

+new tls.TLSSocket(null, {
+  ALPNProtocols: ['http/1.1'],
+  NPNProtocols: ['http/1.1']
+});


What I mean is that options.ALPNProtocols and options.NPNProtocols should still be arrays-of-strings afterwards. Making a copy with Object.assign() should do it.

Would it be possible to flesh out the test somewhat and verify that the options are present in the TLS handhake? You'll need to guard on process.features.tls_alpn and process.features.tls_npn.

I've got the skeleton of this, but I'm not sure where the TLS handshake itself happens (the docs have me tied in knots a bit). I think I should be looking at the secureConnection event. If that's the case, I need to create a server via the TLSSocket constructor and net.createServer. Am I on the right track?

Yep. If you grep for TLSSocket in test/parallel, you should find some existing examples.

Yup. That's where I am now (I'll move this test file to that directory too if you've no objections).

qubyte · 2017-11-01T12:28:55Z

test/parallel/test-tls-socket-constructor-alpn-npn-options-parsing.js

+  });
+
+  tlsSocket.on('secure', common.mustCall((...args) => {
+    // TODO


@bnoordhuis It seems like this event is the one I should be listening for, but it's undocumented. Am I correct? If so, which object/properties do I check to complete the test?

You probably want 'secureConnect', 'secure' is an older, deprecated version.

Once the connection is established, verify the .alpnProtocol and .npnProtocol properties.

'secureConnect' is only called when the socket is created using tls.connect (and not using the TLSSocket constructor directly), so that event will never be emitted. However, the code in tls.connect appears to listen for 'secure' and then do some unrelated synchronous work before emitting 'secureConnect'.

Brings the ALPNProtocols option of TLSSocket into line with the documentation. i.e. a list of strings for protocols may be used, and not only a buffer. Fixes: #16643

qubyte · 2017-11-01T16:46:43Z

@bnoordhuis I reckon this is good for another review now. I was unable to use the secureConnect event since it only occurs when using tls.connect. See also this issue.

bnoordhuis

Thanks, LGTM. CI: https://ci.nodejs.org/job/node-test-pull-request/11132/

bnoordhuis · 2017-11-01T19:35:28Z

test/parallel/test-tls-socket-constructor-alpn-npn-options-parsing.js

+new tls.TLSSocket(null, {
+  ALPNProtocols: ['http/1.1'],
+  NPNProtocols: ['http/1.1']
+});


Is the idea here that the constructor call should work even if ALPN and NPN are disabled?

This was the original test I created for this PR. On master this’ll throw because the constructor expects a buffer (where each option is used). The particular usecase which led to me encountering this issue is a proxy which needs to avoid HTTP/2 (so these options are given without “h2”).

qubyte · 2017-11-01T20:32:38Z

The CI link indicates a failure (I think), but I’m not sure how to interpret the output...

apapirovski · 2017-11-01T20:37:41Z

Failures on the CI are unrelated.

~~Where does this land as far as semverness? The TLSSocket is documented and the "incorrect" behaviour has been around for a while, it's possible there are users relying on it? Or maybe not...~~ (Yeah, no... I'm a dummy.)

qubyte · 2017-11-01T20:43:24Z

As I understand it this’ll fit in a semver patch. Existing behaviour is preserved, and some cases which threw when they should not have will now behave as documented. In other words, this doesn’t break existing usage (which is also consistent with the documentation).

apapirovski · 2017-11-01T20:45:41Z

@qubyte Knew I should've checked the signature for those convert functions... you're absolutely right, you can just ignore me. 😆

qubyte · 2017-11-01T21:23:13Z

Upon clicking through, the checks below all appear to have passed, but the statuses have not been updated. A known quirk?

apapirovski · 2017-11-01T21:25:31Z

Yeah, that's broken... If you're good with build & CI type of stuff, there's an issue and I think they're looking for help nodejs/build#790 :)

qubyte · 2017-11-01T21:33:57Z

Heh, after years of fighting Jenkins my solution was to not use Jenkins. ;)

qubyte · 2017-11-02T16:59:46Z

Is there anything remaining to do for this PR?

apapirovski · 2017-11-04T15:39:10Z

Landed in 291ff72

@qubyte Thanks for the fix and congrats on becoming a Contributor!

Brings the ALPNProtocols & NPNProtocols options of TLSSocket in line with the documentation. i.e. an array of strings for protocols may be used, not only a buffer. PR-URL: #16655 Fixes: https://github.com/node/issues/16643 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>

qubyte · 2017-11-04T15:41:01Z

Sweet! Thank you. :)

Brings the ALPNProtocols & NPNProtocols options of TLSSocket in line with the documentation. i.e. an array of strings for protocols may be used, not only a buffer. PR-URL: nodejs#16655 Fixes: https://github.com/node/issues/16643 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>

gibfahn · 2017-11-14T18:05:00Z

Could someone backport this to v8.x-staging? Info is in the guide, you just raise a backport PR.

MylesBorins · 2017-11-16T23:08:55Z

Should this be backported to v6.x-staging? If yes please follow the guide and raise a backport PR, if not let me know or add the dont-land-on label.

Brings the ALPNProtocols & NPNProtocols options of TLSSocket in line with the documentation. i.e. an array of strings for protocols may be used, not only a buffer. PR-URL: nodejs#16655 Fixes: https://github.com/node/issues/16643 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>

Brings the ALPNProtocols & NPNProtocols options of TLSSocket in line with the documentation. i.e. an array of strings for protocols may be used, not only a buffer. Backport-PR-URL: #21721 PR-URL: #16655 Fixes: https://github.com/node/issues/16643 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>

nodejs-github-bot added the tls Issues and PRs related to the tls subsystem. label Oct 31, 2017

bnoordhuis reviewed Nov 1, 2017

View reviewed changes

qubyte commented Nov 1, 2017

View reviewed changes

tls: allow TLSSocket construction with a list of ALPNProtocols

b82059f

Brings the ALPNProtocols option of TLSSocket into line with the documentation. i.e. a list of strings for protocols may be used, and not only a buffer. Fixes: #16643

bnoordhuis approved these changes Nov 1, 2017

View reviewed changes

jasnell approved these changes Nov 2, 2017

View reviewed changes

apapirovski approved these changes Nov 4, 2017

View reviewed changes

apapirovski closed this Nov 4, 2017

qubyte deleted the alpn-protocols-fix branch November 6, 2017 15:17

cjihrig mentioned this pull request Nov 6, 2017

v9.1.0 proposal #16851

Merged

gibfahn added the backport-requested-v8.x label Nov 14, 2017

MylesBorins added the backport-requested-v6.x label Nov 16, 2017

BethGriggs mentioned this pull request Jul 9, 2018

[v8.x backport] tls: accept array of protocols in TLSSocket #21721

Closed

2 tasks

MylesBorins added dont-land-on-v6.x and removed backport-requested-v6.x labels Aug 1, 2018

MylesBorins mentioned this pull request Aug 16, 2018

v8.12.0 proposal #21593

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tls: allow TLSSocket construction with a list of ALPNProtocols #16655

tls: allow TLSSocket construction with a list of ALPNProtocols #16655

qubyte commented Oct 31, 2017

qubyte commented Oct 31, 2017 •

edited

Loading

qubyte commented Oct 31, 2017 •

edited

Loading

bnoordhuis Nov 1, 2017

qubyte Nov 1, 2017

bnoordhuis Nov 1, 2017

qubyte Nov 1, 2017

bnoordhuis Nov 1, 2017

qubyte Nov 1, 2017

qubyte Nov 1, 2017

bnoordhuis Nov 1, 2017

qubyte Nov 1, 2017

qubyte commented Nov 1, 2017

bnoordhuis left a comment

bnoordhuis Nov 1, 2017

qubyte Nov 1, 2017

qubyte commented Nov 1, 2017

apapirovski commented Nov 1, 2017 •

edited

Loading

qubyte commented Nov 1, 2017

apapirovski commented Nov 1, 2017

qubyte commented Nov 1, 2017

apapirovski commented Nov 1, 2017

qubyte commented Nov 1, 2017

qubyte commented Nov 2, 2017

apapirovski commented Nov 4, 2017

qubyte commented Nov 4, 2017

gibfahn commented Nov 14, 2017

MylesBorins commented Nov 16, 2017

tls: allow TLSSocket construction with a list of ALPNProtocols #16655

tls: allow TLSSocket construction with a list of ALPNProtocols #16655

Conversation

qubyte commented Oct 31, 2017

Checklist

Affected core subsystem(s)

qubyte commented Oct 31, 2017 • edited Loading

qubyte commented Oct 31, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

qubyte commented Nov 1, 2017

bnoordhuis left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

qubyte commented Nov 1, 2017

apapirovski commented Nov 1, 2017 • edited Loading

qubyte commented Nov 1, 2017

apapirovski commented Nov 1, 2017

qubyte commented Nov 1, 2017

apapirovski commented Nov 1, 2017

qubyte commented Nov 1, 2017

qubyte commented Nov 2, 2017

apapirovski commented Nov 4, 2017

qubyte commented Nov 4, 2017

gibfahn commented Nov 14, 2017

MylesBorins commented Nov 16, 2017

qubyte commented Oct 31, 2017 •

edited

Loading

qubyte commented Oct 31, 2017 •

edited

Loading

apapirovski commented Nov 1, 2017 •

edited

Loading