Implements Node.js behaviour for parallel/test-tls-set-ciphers-error.js

src/js/internal/tls.ts

@@ -1,5 +1,11 @@
 const { isTypedArray, isArrayBuffer } = require("node:util/types");
 
+const DEFAULT_CIPHERS =
+  "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256";
+
+const DEFAULT_CIPHERS_LIST = DEFAULT_CIPHERS.split(":");
+const DEFAULT_CIPHERS_SET = new Set([...DEFAULT_CIPHERS_LIST.map(c => c.toLowerCase()), ...DEFAULT_CIPHERS_LIST]);
+
 function isPemObject(obj: unknown): obj is { pem: unknown } {
   return $isObject(obj) && "pem" in obj;
 }
@@ -48,6 +54,24 @@ function isValidTLSArray(obj: unknown) {
   return false;
 }
 
+function validateCiphers(ciphers: string) {
+  const requested = ciphers.split(":");
+  for (const r of requested) {
+    if (!DEFAULT_CIPHERS_SET.has(r)) {
+      throw $ERR_SSL_NO_CIPHER_MATCH();
+    }
+  }
+}
+
 const VALID_TLS_ERROR_MESSAGE_TYPES = "string or an instance of Buffer, TypedArray, DataView, or BunFile";
 
-export { VALID_TLS_ERROR_MESSAGE_TYPES, isValidTLSArray, isValidTLSItem, throwOnInvalidTLSArray };
+export {
+  DEFAULT_CIPHERS,
+  DEFAULT_CIPHERS_LIST,
+  DEFAULT_CIPHERS_SET,
+  isValidTLSArray,
+  isValidTLSItem,
+  throwOnInvalidTLSArray,
+  VALID_TLS_ERROR_MESSAGE_TYPES,
+  validateCiphers,
+};

src/js/node/net.ts

@@ -739,6 +739,8 @@ Socket.prototype.connect = function connect(...args) {
     // Client always request Cert
     this._requestCert = true;
     if (tls) {
+      console.log("TLS TLS TLS", tls);
+
       if (typeof rejectUnauthorized !== "undefined") {
         this._rejectUnauthorized = rejectUnauthorized;
         tls.rejectUnauthorized = rejectUnauthorized;

src/js/node/tls.ts

@@ -4,7 +4,7 @@
 const { Duplex } = require("node:stream");
 const [addServerName] = $zig("socket.zig", "createNodeTLSBinding");
 const { throwNotImplemented } = require("internal/shared");
-const { throwOnInvalidTLSArray } = require("internal/tls");
+const { throwOnInvalidTLSArray, DEFAULT_CIPHERS, DEFAULT_CIPHERS_SET, validateCiphers } = require("internal/tls");
 
 const { Server: NetServer, Socket: NetSocket } = net;
 
@@ -313,6 +313,11 @@
 
   NetSocket.$call(this, options);
 
+  this.ciphers = options.ciphers;
+  if (this.ciphers) {
+    validateCiphers(options.ciphers);
+  }
+
   if (typeof options === "object") {
     const { ALPNProtocols } = options;
     if (ALPNProtocols) {
@@ -483,6 +488,7 @@
     session: this[ksession],
     rejectUnauthorized: this._rejectUnauthorized,
     requestCert: this._requestCert,
+    ciphers: this.ciphers,
     ...this[ksecureContext],
   };
 };
@@ -587,14 +593,9 @@
           throw $ERR_INVALID_ARG_TYPE("options.ciphers", "string", options.ciphers);
         }
 
-        const requested = options.ciphers.split(":");
-        for (const r of requested) {
-          if (!DEFAULT_CIPHERS_SET.has(r)) {
-            throw $ERR_SSL_NO_CIPHER_MATCH();
-          }
-        }
+        validateCiphers(options.ciphers);
 
-        // TODO: Use the ciphers?
+        // TODO: Pass the ciphers
       }
     }
   };
@@ -636,14 +637,9 @@
 }
 const DEFAULT_ECDH_CURVE = "auto",
   // https://github.com/Jarred-Sumner/uSockets/blob/fafc241e8664243fc0c51d69684d5d02b9805134/src/crypto/openssl.c#L519-L523
-  DEFAULT_CIPHERS =
-    "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256",
   DEFAULT_MIN_VERSION = "TLSv1.2",
   DEFAULT_MAX_VERSION = "TLSv1.3";
 
-const DEFAULT_CIPHERS_LIST = DEFAULT_CIPHERS.split(":");
-const DEFAULT_CIPHERS_SET = new Set([...DEFAULT_CIPHERS_LIST.map(c => c.toLowerCase()), ...DEFAULT_CIPHERS_LIST]);
-
 function normalizeConnectArgs(listArgs) {
   const args = net._normalizeArgs(listArgs);
   $assert($isObject(args[0]));

test/js/node/test/parallel/test-tls-handshake-error.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const tls = require('tls');
+
+const fixtures = require('../common/fixtures');
+
+const server = tls.createServer({
+  key: fixtures.readKey('agent1-key.pem'),
+  cert: fixtures.readKey('agent1-cert.pem'),
+  rejectUnauthorized: true
+}, common.mustNotCall()).listen(0, common.mustCall(function() {
+  assert.throws(() => {
+    tls.connect({
+      port: this.address().port,
+      ciphers: 'no-such-cipher'
+    }, common.mustNotCall());
+  }, /no cipher match/i);
+
+  server.close();
+}));