From 5bfbe5ceaecb6412b176db446caf00f77f84bae7 Mon Sep 17 00:00:00 2001 From: Ben Noordhuis Date: Sat, 17 Mar 2018 05:13:47 +0100 Subject: [PATCH] tls: drop NPN (next protocol negotiation) support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit NPN has been superseded by ALPN. Chrome and Firefox removed support for NPN in 2016 and 2017 respectively to no ill effect. Fixes: https://github.com/nodejs/node/issues/14602 PR-URL: https://github.com/nodejs/node/pull/19403 Reviewed-By: James M Snell Reviewed-By: Tobias Nießen --- deps/openssl/openssl.gypi | 3 + doc/api/crypto.md | 4 - doc/api/tls.md | 52 +-- lib/_tls_wrap.js | 13 - lib/https.js | 4 - node.gyp | 4 +- src/env.h | 2 - src/node.cc | 7 - src/node_constants.cc | 5 - src/node_crypto.cc | 182 +------- src/node_crypto.h | 18 +- src/tls_wrap.cc | 2 +- .../test-https-argument-of-creating.js | 17 +- test/parallel/test-tls-alpn-server-client.js | 435 ++---------------- test/parallel/test-tls-npn-server-client.js | 118 ----- ...ocket-constructor-alpn-options-parsing.js} | 29 +- 16 files changed, 73 insertions(+), 822 deletions(-) delete mode 100644 test/parallel/test-tls-npn-server-client.js rename test/parallel/{test-tls-socket-constructor-alpn-npn-options-parsing.js => test-tls-socket-constructor-alpn-options-parsing.js} (65%) diff --git a/deps/openssl/openssl.gypi b/deps/openssl/openssl.gypi index 871cec0c7e4696..d6d2589083bbce 100644 --- a/deps/openssl/openssl.gypi +++ b/deps/openssl/openssl.gypi @@ -1268,6 +1268,9 @@ # the real driver but that poses a security liability when an attacker # is able to create a malicious DLL in one of the default search paths. 'OPENSSL_NO_HW', + + # Disable NPN (Next Protocol Negotiation), superseded by ALPN. + 'OPENSSL_NO_NEXTPROTONEG', ], 'openssl_default_defines_win': [ 'MK1MF_BUILD', diff --git a/doc/api/crypto.md b/doc/api/crypto.md index 4c2354f52eb44d..f90c2cfe2e3465 100644 --- a/doc/api/crypto.md +++ b/doc/api/crypto.md @@ -2412,10 +2412,6 @@ the `crypto`, `tls`, and `https` modules and are generally specific to OpenSSL. DH_NOT_SUITABLE_GENERATOR - - NPN_ENABLED - - ALPN_ENABLED diff --git a/doc/api/tls.md b/doc/api/tls.md index 39ef97562a3b78..f519681c62a690 100644 --- a/doc/api/tls.md +++ b/doc/api/tls.md @@ -104,22 +104,17 @@ not required and a default ECDHE curve will be used. The `ecdhCurve` property can be used when creating a TLS Server to specify the list of names of supported curves to use, see [`tls.createServer()`] for more info. -### ALPN, NPN, and SNI +### ALPN and SNI -ALPN (Application-Layer Protocol Negotiation Extension), NPN (Next -Protocol Negotiation) and, SNI (Server Name Indication) are TLS -handshake extensions: +ALPN (Application-Layer Protocol Negotiation Extension) and +SNI (Server Name Indication) are TLS handshake extensions: -* ALPN/NPN - Allows the use of one TLS server for multiple protocols (HTTP, - SPDY, HTTP/2) +* ALPN - Allows the use of one TLS server for multiple protocols (HTTP, HTTP/2) * SNI - Allows the use of one TLS server for multiple hostnames with different SSL certificates. -Use of ALPN is recommended over NPN. The NPN extension has never been -formally defined or documented and generally not recommended for use. - ### Client-initiated renegotiation attack mitigation @@ -332,12 +327,9 @@ server. If `tlsSocket.authorized` is `false`, then `socket.authorizationError` is set to describe how authorization failed. Note that depending on the settings of the TLS server, unauthorized connections may still be accepted. -The `tlsSocket.npnProtocol` and `tlsSocket.alpnProtocol` properties are strings -that contain the selected NPN and ALPN protocols, respectively. When both NPN -and ALPN extensions are received, ALPN takes precedence over NPN and the next -protocol is selected by ALPN. - -When ALPN has no selected protocol, `tlsSocket.alpnProtocol` returns `false`. +The `tlsSocket.alpnProtocol` property is a string that contains the selected +ALPN protocol. When ALPN has no selected protocol, `tlsSocket.alpnProtocol` +equals `false`. The `tlsSocket.servername` property is a string containing the server name requested via SNI. @@ -468,7 +460,6 @@ changes: (`isServer` is true) may optionally set `requestCert` to true to request a client certificate. * `rejectUnauthorized`: Optional, see [`tls.createServer()`][] - * `NPNProtocols`: Optional, see [`tls.createServer()`][] * `ALPNProtocols`: Optional, see [`tls.createServer()`][] * `SNICallback`: Optional, see [`tls.createServer()`][] * `session` {Buffer} An optional `Buffer` instance containing a TLS session. @@ -509,9 +500,9 @@ regardless of whether or not the server's certificate has been authorized. It is the client's responsibility to check the `tlsSocket.authorized` property to determine if the server certificate was signed by one of the specified CAs. If `tlsSocket.authorized === false`, then the error can be found by examining the -`tlsSocket.authorizationError` property. If either ALPN or NPN was used, -the `tlsSocket.alpnProtocol` or `tlsSocket.npnProtocol` properties can be -checked to determine the negotiated protocol. +`tlsSocket.authorizationError` property. If ALPN was used, the +`tlsSocket.alpnProtocol` property can be checked to determine the negotiated +protocol. ### tlsSocket.address()