Can't get TLSSocket.renegotiate() to work

[alexlamsl]

Looks like somebody has asked this a while ago on StackOverflow to no avail.

Basically, on the server-side you call:

var result = socket.renegotiate({
  requestCert:true,
  rejectUnauthorized:true
}, function(err) {
  console.error(err);
});

And you will get result === true, but otherwise nothing happens - the callback is never executed.

On the client side, I get the following error:

{ [Error: socket hang up] code: 'ECONNRESET' }

Judging by the test case within io.js, you have a special case for this, but of course I would have no access to constants so I'm not sure what to do here...

[alexlamsl]

Right - so tls.CLIENT_RENEG_LIMIT apparently applies to server-initiated renegotiations as well. As I have set it to 0 before, that is why it is failing.

HOWEVER, setting it to 1 would still fail - it needs to be 2 for some bizarre reasons...

The problem now becomes that socket.getPeerCertificate() returns null (called on the server), which is odd because requestCert and rejectUnauthorized are set to true, and that the client has provided a valid certificate.

[alexlamsl]

Inside the callback, console.log(socket.destroyed) prints true (err parameter from the callback is null, which according to the documentation indicates successful renegotiation)

[mscdex]

Judging by the test case within io.js, you have a special case for this, but of course I would have no access to constants so I'm not sure what to do here...

FWIW you should be able to get at the constants the same way the test does: require('constants')

[alexlamsl]

@mscdex Ah, I've only tested it on REPL, and it wasn't imported by default - thanks for the tip!

I shall try to get at it further to see if I can find out more about why I can a successful callback, with the original socket closed/destroyed, and no other sockets to be seen/provided.

I was running into a separate issue with client-side https.Agent({keepAlive:true}) killing my app when the server closes the connection and got distracted...

[alexlamsl]

Right, so I managed to get this to work as expected by:

require('https').createServer({
  ...
  secureOptions:require('constants').SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
}, ...).listen(443);

I don't know if this is a special case or whether this should be set as default to improve usability, so I'll leave it up to you guys to decide whether to close this issue or not.

[alexlamsl]

To summarise:

• tls.CLIENT_RENEG_LIMIT needs to be set to >= 2 even if you perform a single, server-intiated, renegotiation
• pass in constants.SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION to https.createServer({secureOptions:...}) so that the socket remains active after successful renegotiations

[bnoordhuis]

tls.CLIENT_RENEG_LIMIT needs to be set to >= 2 even if you perform a single, server-intiated, renegotiation

There is no intrinsic need for that but it's possible the client insists on renegotiating as well. You should be able to test that with openssl s_client.

[alexlamsl]

@bnoordhuis FYI, the client in this case is https.get()

Hi Alex,
I was the one that asked the question on StackOverflow. I tried the code with your settings today, but couldn't it get to work. Would you please share your code so that I can see what I'm doing wrong?
Thanks a lot,
Thomas

[alexlamsl]

@consemo The test case in io.js is literally how it is done.

[Trott]

I don't know if this is a special case or whether this should be set as default to improve usability, so I'll leave it up to you guys to decide whether to close this issue or not.

Anyone have an opinion as to whether this should be closed (that is, current behavior is desirable) or labeled feature request (that is, default should change so that secureOptions includes constants.SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION by default)? I don't know what the ramifications or side effects might be.

/cc @nodejs/collaborators

Hi all,

I'm sorry for not replying earlier. I totally forgot to close the issue report here.

Because I finally managed to get it work there is no issue with node.js. If somebody is interested you can find a working example here.

Thus, the issue can be closed.

Thanks,
Thomas

[benjamingr]

Thanks for following up Thomas.