1'use strict';
2const common = require('../common');
3if (!common.hasCrypto)
4  common.skip('missing crypto');
5
6const fixtures = require('../common/fixtures');
7const { inspect } = require('util');
8
9// Test cipher: option for TLS.
10
11const {
12  assert, connect, keys
13} = require(fixtures.path('tls-connect'));
14
15
16function test(cciphers, sciphers, cipher, cerr, serr, options) {
17  assert(cipher || cerr || serr, 'test missing any expectations');
18  const where = inspect(new Error()).split('\n')[2].replace(/[^(]*/, '');
19
20  const max_tls_ver = (ciphers, options) => {
21    if (options instanceof Object && Object.hasOwn(options, 'maxVersion'))
22      return options.maxVersion;
23    if ((typeof ciphers === 'string' || ciphers instanceof String) && ciphers.length > 0 && !ciphers.includes('TLS_'))
24      return 'TLSv1.2';
25
26    return 'TLSv1.3';
27  };
28
29  connect({
30    client: {
31      checkServerIdentity: (servername, cert) => { },
32      ca: `${keys.agent1.cert}\n${keys.agent6.ca}`,
33      ciphers: cciphers,
34      maxVersion: max_tls_ver(cciphers, options),
35    },
36    server: {
37      cert: keys.agent6.cert,
38      key: keys.agent6.key,
39      ciphers: sciphers,
40      maxVersion: max_tls_ver(sciphers, options),
41    },
42  }, common.mustCall((err, pair, cleanup) => {
43    function u(_) { return _ === undefined ? 'U' : _; }
44    console.log('test:', u(cciphers), u(sciphers),
45                'expect', u(cipher), u(cerr), u(serr));
46    console.log('  ', where);
47    if (!cipher) {
48      console.log('client', pair.client.err ? pair.client.err.code : undefined);
49      console.log('server', pair.server.err ? pair.server.err.code : undefined);
50      if (cerr) {
51        assert(pair.client.err);
52        assert.strictEqual(pair.client.err.code, cerr);
53      }
54      if (serr) {
55        assert(pair.server.err);
56        assert.strictEqual(pair.server.err.code, serr);
57      }
58      return cleanup();
59    }
60
61    const reply = 'So long and thanks for all the fish.';
62
63    assert.ifError(err);
64    assert.ifError(pair.server.err);
65    assert.ifError(pair.client.err);
66    assert(pair.server.conn);
67    assert(pair.client.conn);
68    assert.strictEqual(pair.client.conn.getCipher().name, cipher);
69    assert.strictEqual(pair.server.conn.getCipher().name, cipher);
70
71    pair.server.conn.write(reply);
72
73    pair.client.conn.on('data', common.mustCall((data) => {
74      assert.strictEqual(data.toString(), reply);
75      return cleanup();
76    }));
77  }));
78}
79
80const U = undefined;
81
82// Have shared ciphers.
83test(U, 'AES256-SHA', 'AES256-SHA');
84test('AES256-SHA', U, 'AES256-SHA');
85
86test(U, 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
87test('TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
88
89// Do not have shared ciphers.
90test('TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256',
91     U, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE', 'ERR_SSL_NO_SHARED_CIPHER');
92
93test('AES128-SHA', 'AES256-SHA', U, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE',
94     'ERR_SSL_NO_SHARED_CIPHER');
95test('AES128-SHA:TLS_AES_256_GCM_SHA384',
96     'TLS_CHACHA20_POLY1305_SHA256:AES256-SHA',
97     U, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE', 'ERR_SSL_NO_SHARED_CIPHER');
98
99// Cipher order ignored, TLS1.3 chosen before TLS1.2.
100test('AES256-SHA:TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
101test(U, 'AES256-SHA:TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
102
103// Cipher order ignored, TLS1.3 before TLS1.2 and
104// cipher suites are not disabled if TLS ciphers are set only
105// TODO: maybe these tests should be reworked so maxVersion clamping
106// is done explicitly and not implicitly in the test() function
107test('AES256-SHA', U, 'TLS_AES_256_GCM_SHA384', U, U, { maxVersion: 'TLSv1.3' });
108test(U, 'AES256-SHA', 'TLS_AES_256_GCM_SHA384', U, U, { maxVersion: 'TLSv1.3' });
109
110// TLS_AES_128_CCM_8_SHA256 & TLS_AES_128_CCM_SHA256 are not enabled by
111// default, but work.
112test('TLS_AES_128_CCM_8_SHA256', U,
113     U, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE', 'ERR_SSL_NO_SHARED_CIPHER');
114
115test('TLS_AES_128_CCM_8_SHA256', 'TLS_AES_128_CCM_8_SHA256',
116     'TLS_AES_128_CCM_8_SHA256');
117
118// Invalid cipher values
119test(9, 'AES256-SHA', U, 'ERR_INVALID_ARG_TYPE', U);
120test('AES256-SHA', 9, U, U, 'ERR_INVALID_ARG_TYPE');
121test(':', 'AES256-SHA', U, 'ERR_INVALID_ARG_VALUE', U);
122test('AES256-SHA', ':', U, U, 'ERR_INVALID_ARG_VALUE');
123
124// Using '' is synonymous for "use default ciphers"
125test('TLS_AES_256_GCM_SHA384', '', 'TLS_AES_256_GCM_SHA384');
126test('', 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
127
128// Using null should be treated the same as undefined.
129test(null, 'AES256-SHA', 'AES256-SHA');
130test('AES256-SHA', null, 'AES256-SHA');
131