|
| 1 | +// Flags: --expose-internals |
1 | 2 | 'use strict'; |
2 | 3 | const common = require('../common'); |
3 | 4 | if (!common.hasCrypto) |
4 | 5 | common.skip('missing crypto'); |
5 | 6 |
|
6 | | -const { hasOpenSSL } = require('../common/crypto'); |
| 7 | +// OpenSSL has a set of security levels which affect what algorithms |
| 8 | +// are available by default. Different OpenSSL veresions have different |
| 9 | +// default security levels and we use this value to adjust what a test |
| 10 | +// expects based on the security level. You can read more in |
| 11 | +// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour |
| 12 | +const secLevel = require('internal/crypto/util').getOpenSSLSecLevel(); |
7 | 13 | const assert = require('assert'); |
8 | 14 | const tls = require('tls'); |
9 | 15 | const fixtures = require('../common/fixtures'); |
@@ -38,8 +44,9 @@ function test(size, err, next) { |
38 | 44 | server.listen(0, function() { |
39 | 45 | // Client set minimum DH parameter size to 2048 or 3072 bits |
40 | 46 | // so that it fails when it makes a connection to the tls |
41 | | - // server where is too small |
42 | | - const minDHSize = hasOpenSSL(3, 2) ? 3072 : 2048; |
| 47 | + // server where is too small. This depends on the openssl |
| 48 | + // security level |
| 49 | + const minDHSize = (secLevel > 1) ? 3072 : 2048; |
43 | 50 | const client = tls.connect({ |
44 | 51 | minDHSize: minDHSize, |
45 | 52 | port: this.address().port, |
@@ -77,8 +84,8 @@ function testDHE3072() { |
77 | 84 | test(3072, false, null); |
78 | 85 | } |
79 | 86 |
|
80 | | -if (hasOpenSSL(3, 2)) { |
81 | | - // Minimum size for OpenSSL 3.2 is 2048 by default |
| 87 | +if (secLevel > 1) { |
| 88 | + // Minimum size for OpenSSL security level 2 and above is 2048 by default |
82 | 89 | testDHE2048(true, testDHE3072); |
83 | 90 | } else { |
84 | 91 | testDHE1024(); |
|