Implements Node.js behaviour for parallel/test-tls-set-ciphers-error.js

src/bun.js/bindings/ErrorCode.cpp

@@ -2278,6 +2278,17 @@ JSC_DEFINE_HOST_FUNCTION(Bun::jsFunctionMakeErrorWithCode, (JSC::JSGlobalObject
         return JSC::JSValue::encode(createError(globalObject, ErrorCode::ERR_TLS_CERT_ALTNAME_FORMAT, "Invalid subject alternative name string"_s));
     case ErrorCode::ERR_TLS_SNI_FROM_SERVER:
         return JSC::JSValue::encode(createError(globalObject, ErrorCode::ERR_TLS_SNI_FROM_SERVER, "Cannot issue SNI from a TLS server-side socket"_s));
+    case ErrorCode::ERR_SSL_NO_CIPHER_MATCH: {
+        auto err = createError(globalObject, ErrorCode::ERR_SSL_NO_CIPHER_MATCH, "No cipher match"_s);
+
+        auto reason = JSC::jsString(vm, WTF::String("no cipher match"_s));
+        err->putDirect(vm, Identifier::fromString(vm, "reason"_s), reason);
+
+        auto library = JSC::jsString(vm, WTF::String("SSL routines"_s));
+        err->putDirect(vm, Identifier::fromString(vm, "library"_s), library);
+
+        return JSC::JSValue::encode(err);
+    }
     case ErrorCode::ERR_INVALID_URI:
         return JSC::JSValue::encode(createError(globalObject, ErrorCode::ERR_INVALID_URI, "URI malformed"_s));
     case ErrorCode::ERR_HTTP2_PSEUDOHEADER_NOT_ALLOWED:

src/bun.js/bindings/ErrorCode.ts

@@ -236,6 +236,7 @@ const errors: ErrorCodeMapping = [
   ["ERR_TLS_PSK_SET_IDENTITY_HINT_FAILED", Error],
   ["ERR_TLS_RENEGOTIATION_DISABLED", Error],
   ["ERR_TLS_SNI_FROM_SERVER", Error],
+  ["ERR_SSL_NO_CIPHER_MATCH", Error],
   ["ERR_UNAVAILABLE_DURING_EXIT", Error],
   ["ERR_UNCAUGHT_EXCEPTION_CAPTURE_ALREADY_SET", Error],
   ["ERR_UNESCAPED_CHARACTERS", TypeError],

src/js/builtins.d.ts

@@ -744,6 +744,7 @@ declare function $ERR_TLS_RENEGOTIATION_DISABLED(): Error;
 declare function $ERR_UNAVAILABLE_DURING_EXIT(): Error;
 declare function $ERR_TLS_CERT_ALTNAME_FORMAT(): SyntaxError;
 declare function $ERR_TLS_SNI_FROM_SERVER(): Error;
+declare function $ERR_SSL_NO_CIPHER_MATCH(): Error;
 declare function $ERR_INVALID_URI(): URIError;
 declare function $ERR_HTTP2_PSEUDOHEADER_NOT_ALLOWED(): TypeError;
 declare function $ERR_HTTP2_INFO_STATUS_NOT_ALLOWED(): RangeError;

src/js/node/tls.ts

@@ -247,8 +247,10 @@ var InternalSecureContext = class SecureContext {
   }
 };
 
-function SecureContext(options) {
-  return new InternalSecureContext(options);
+function SecureContext(options): void {
+  // TODO: The `never` exists because TypeScript only lets you construct functions that return void
+  // but in reality we should just be calling like InternalSecureContext.$call or similar
+  return new InternalSecureContext(options) as never;
 }
 
 function createSecureContext(options) {
@@ -562,6 +564,21 @@ function Server(options, secureConnectionListener): void {
       if (typeof rejectUnauthorized !== "undefined") {
         this._rejectUnauthorized = rejectUnauthorized;
       } else this._rejectUnauthorized = rejectUnauthorizedDefault;
+
+      if (typeof options.ciphers !== "undefined") {
+        if (typeof options.ciphers !== "string") {
+          throw $ERR_INVALID_ARG_TYPE("options.ciphers", "string", options.ciphers);
+        }
+
+        const requested = options.ciphers.split(":");
+        for (const r of requested) {
+          if (!DEFAULT_CIPHERS_SET.has(r)) {
+            throw $ERR_SSL_NO_CIPHER_MATCH();
+          }
+        }
+
+        // TODO: Use the ciphers?
+      }
     }
   };
 
@@ -607,6 +624,9 @@ const DEFAULT_ECDH_CURVE = "auto",
   DEFAULT_MIN_VERSION = "TLSv1.2",
   DEFAULT_MAX_VERSION = "TLSv1.3";
 
+const DEFAULT_CIPHERS_LIST = DEFAULT_CIPHERS.split(":");
+const DEFAULT_CIPHERS_SET = new Set([...DEFAULT_CIPHERS_LIST.map(c => c.toLowerCase()), ...DEFAULT_CIPHERS_LIST]);
+
 function normalizeConnectArgs(listArgs) {
   const args = net._normalizeArgs(listArgs);
   $assert($isObject(args[0]));
@@ -631,10 +651,12 @@ function normalizeConnectArgs(listArgs) {
 function connect(...args) {
   let normal = normalizeConnectArgs(args);
   const options = normal[0];
-  const { ALPNProtocols } = options;
+  const { ALPNProtocols } = options as { ALPNProtocols?: unknown };
+
   if (ALPNProtocols) {
     convertALPNProtocols(ALPNProtocols, options);
   }
+
   return new TLSSocket(options).connect(normal);
 }
 

src/js/private.d.ts

@@ -223,3 +223,7 @@ declare function $newZigFunction<T = (...args: any) => any>(
  */
 declare function $bindgenFn<T = (...args: any) => any>(filename: string, symbol: string): T;
 // NOTE: $debug, $assert, and $isPromiseFulfilled omitted
+
+declare module "node:net" {
+  export function _normalizeArgs(args: any[]): unknown[];
+}

test/js/node/test/parallel/test-tls-set-ciphers-error.js

@@ -0,0 +1,25 @@
+'use strict';
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const tls = require('tls');
+const fixtures = require('../common/fixtures');
+
+{
+  const options = {
+    key: fixtures.readKey('agent2-key.pem'),
+    cert: fixtures.readKey('agent2-cert.pem'),
+    ciphers: 'aes256-sha'
+  };
+  assert.throws(() => tls.createServer(options, common.mustNotCall()),
+                /no[_ ]cipher[_ ]match/i);
+  options.ciphers = 'FOOBARBAZ';
+  assert.throws(() => tls.createServer(options, common.mustNotCall()),
+                /no[_ ]cipher[_ ]match/i);
+  options.ciphers = 'TLS_not_a_cipher';
+  assert.throws(() => tls.createServer(options, common.mustNotCall()),
+                /no[_ ]cipher[_ ]match/i);
+}

test/js/node/tls/node-tls-no-cipher-match-error.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, test } from "bun:test";
+import * as tls from "node:tls";
+
+const fixtures = require("../test/common/fixtures");
+
+describe("TLS No Cipher Match Error code matches Node.js", () => {
+  test("The error should have all the same properties as Node.js", () => {
+    const options = {
+      key: fixtures.readKey("agent2-key.pem"),
+      cert: fixtures.readKey("agent2-cert.pem"),
+      ciphers: "aes256-sha",
+    };
+
+    expect(() =>
+      tls.createServer(options, () => {
+        throw new Error("should not be called");
+      }),
+    ).toThrow({
+      code: "ERR_SSL_NO_CIPHER_MATCH",
+      message: "No cipher match",
+      library: "SSL routines",
+      reason: "no cipher match",
+    });
+
+    options.ciphers = "FOOBARBAZ";
+    expect(() =>
+      tls.createServer(options, () => {
+        throw new Error("should not be called");
+      }),
+    ).toThrow({
+      code: "ERR_SSL_NO_CIPHER_MATCH",
+      message: "No cipher match",
+      library: "SSL routines",
+      reason: "no cipher match",
+    });
+
+    options.ciphers = "TLS_not_a_cipher";
+    expect(() =>
+      tls.createServer(options, () => {
+        throw new Error("should not be called");
+      }),
+    ).toThrow({
+      code: "ERR_SSL_NO_CIPHER_MATCH",
+      message: "No cipher match",
+      library: "SSL routines",
+      reason: "no cipher match",
+    });
+  });
+});