GeezerVison is showing github.com — crypto: deprecate {ecdhCurve: false} · nodejs/node@31dadd2
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: doc/api/deprecations.md +10Lines changed: 10 additions & 0 deletions - Display the source diff
- Display the rich diff
| Original file line number | Diff line number | Diff line change |
|---|
@@ -737,6 +737,16 @@ Type: Runtime |
737 | 737 | internal mechanics of the `REPLServer` itself, and is therefore not |
738 | 738 | necessary in user space. |
739 | 739 |
|
| 740 | +<a id="DEP0083"></a> |
| 741 | +### DEP0083: Disabling ECDH by setting ecdhCurve to false |
| 742 | +
|
| 743 | +Type: Runtime |
| 744 | +
|
| 745 | +The `ecdhCurve` option to `tls.createSecureContext()` and `tls.TLSSocket` could |
| 746 | +be set to `false` to disable ECDH entirely on the server only. This mode is |
| 747 | +deprecated in preparation for migrating to OpenSSL 1.1.0 and consistency with |
| 748 | +the client. Use the `ciphers` parameter instead. |
| 749 | +
|
740 | 750 |
|
741 | 751 | [`Buffer.allocUnsafeSlow(size)`]: buffer.html#buffer_class_method_buffer_allocunsafeslow_size |
742 | 752 | [`Buffer.from(array)`]: buffer.html#buffer_class_method_buffer_from_array |
|
Collapse file
Copy file name to clipboardExpand all lines: lib/_tls_common.js +12Lines changed: 12 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -65,6 +65,16 @@ function validateKeyCert(value, type) { |
65 | 65 | exports.SecureContext = SecureContext; |
66 | 66 |
|
67 | 67 |
|
| 68 | +function ecdhCurveWarning() { |
| 69 | + if (ecdhCurveWarning.emitted) return; |
| 70 | + process.emitWarning('{ ecdhCurve: false } is deprecated.', |
| 71 | + 'DeprecationWarning', |
| 72 | + 'DEP0083'); |
| 73 | + ecdhCurveWarning.emitted = true; |
| 74 | +} |
| 75 | +ecdhCurveWarning.emitted = false; |
| 76 | + |
| 77 | + |
68 | 78 | exports.createSecureContext = function createSecureContext(options, context) { |
69 | 79 | if (!options) options = {}; |
70 | 80 |
|
@@ -140,6 +150,8 @@ exports.createSecureContext = function createSecureContext(options, context) { |
140 | 150 | c.context.setECDHCurve(tls.DEFAULT_ECDH_CURVE); |
141 | 151 | else if (options.ecdhCurve) |
142 | 152 | c.context.setECDHCurve(options.ecdhCurve); |
| 153 | + else |
| 154 | + ecdhCurveWarning(); |
143 | 155 |
|
144 | 156 | if (options.dhparam) { |
145 | 157 | const warning = c.context.setDHParam(options.dhparam); |
|
Collapse file
Copy file name to clipboardExpand all lines: test/parallel/test-tls-ecdh-disable.js +8Lines changed: 8 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -31,6 +31,11 @@ if (!common.hasCrypto) |
31 | 31 | if (!common.opensslCli) |
32 | 32 | common.skip('missing openssl-cli'); |
33 | 33 |
|
| 34 | +const OPENSSL_VERSION_NUMBER = |
| 35 | + require('crypto').constants.OPENSSL_VERSION_NUMBER; |
| 36 | +if (OPENSSL_VERSION_NUMBER >= 0x10100000) |
| 37 | + common.skip('false ecdhCurve not supported in OpenSSL 1.1.0'); |
| 38 | + |
34 | 39 | const assert = require('assert'); |
35 | 40 | const tls = require('tls'); |
36 | 41 | const exec = require('child_process').exec; |
@@ -42,6 +47,9 @@ const options = { |
42 | 47 | ecdhCurve: false |
43 | 48 | }; |
44 | 49 |
|
| 50 | +common.expectWarning('DeprecationWarning', |
| 51 | + '{ ecdhCurve: false } is deprecated.'); |
| 52 | + |
45 | 53 | const server = tls.createServer(options, common.mustNotCall()); |
46 | 54 |
|
47 | 55 | server.listen(0, '127.0.0.1', common.mustCall(function() { |
|