|
| 1 | +'use strict'; |
| 2 | +// TLS records that are already buffered are emitted as one chunk rather than |
| 3 | +// one chunk per record. The end of the stream, clean or not, must still be |
| 4 | +// reported after the data that precedes it. |
| 5 | + |
| 6 | +const common = require('../common'); |
| 7 | +if (!common.hasCrypto) |
| 8 | + common.skip('missing crypto'); |
| 9 | + |
| 10 | +const { isBoringSSL } = require('../common/crypto'); |
| 11 | +const assert = require('assert'); |
| 12 | +const net = require('net'); |
| 13 | +const tls = require('tls'); |
| 14 | +const fixtures = require('../common/fixtures'); |
| 15 | + |
| 16 | +const RECORD_SIZE = 512; |
| 17 | +const RECORDS = 256; |
| 18 | +const payload = Buffer.alloc(RECORD_SIZE * RECORDS); |
| 19 | +for (let i = 0; i < RECORDS; i++) |
| 20 | + payload.fill(i, i * RECORD_SIZE, (i + 1) * RECORD_SIZE); |
| 21 | + |
| 22 | +const serverOptions = { |
| 23 | + key: fixtures.readKey('agent1-key.pem'), |
| 24 | + cert: fixtures.readKey('agent1-cert.pem'), |
| 25 | +}; |
| 26 | +const clientOptions = { |
| 27 | + ca: fixtures.readKey('ca1-cert.pem'), |
| 28 | + servername: 'agent1', |
| 29 | +}; |
| 30 | + |
| 31 | +function sendPayload(socket) { |
| 32 | + assert(socket.setMaxSendFragment(RECORD_SIZE)); |
| 33 | + socket.end(payload); |
| 34 | +} |
| 35 | + |
| 36 | +// Small records are coalesced, and 'end' follows all of the data. |
| 37 | +{ |
| 38 | + const server = tls.createServer(serverOptions, common.mustCall(sendPayload)); |
| 39 | + server.listen(0, common.mustCall(() => { |
| 40 | + const chunks = []; |
| 41 | + const client = tls.connect({ ...clientOptions, port: server.address().port }); |
| 42 | + client.on('data', (chunk) => chunks.push(chunk)); |
| 43 | + client.on('end', common.mustCall(() => { |
| 44 | + assert.deepStrictEqual(Buffer.concat(chunks), payload); |
| 45 | + assert(chunks.length < RECORDS, `${chunks.length} chunks`); |
| 46 | + assert(chunks.every((chunk) => chunk.length <= 16 * 1024)); |
| 47 | + server.close(); |
| 48 | + })); |
| 49 | + })); |
| 50 | +} |
| 51 | + |
| 52 | +// An onread buffer smaller than a record still receives every byte. |
| 53 | +{ |
| 54 | + const server = tls.createServer(serverOptions, common.mustCall(sendPayload)); |
| 55 | + server.listen(0, common.mustCall(() => { |
| 56 | + const chunks = []; |
| 57 | + const client = tls.connect({ |
| 58 | + ...clientOptions, |
| 59 | + port: server.address().port, |
| 60 | + onread: { |
| 61 | + buffer: Buffer.alloc(100), |
| 62 | + callback(nread, buf) { |
| 63 | + chunks.push(Buffer.from(buf.subarray(0, nread))); |
| 64 | + }, |
| 65 | + }, |
| 66 | + }); |
| 67 | + client.on('end', common.mustCall(() => { |
| 68 | + assert.deepStrictEqual(Buffer.concat(chunks), payload); |
| 69 | + server.close(); |
| 70 | + })); |
| 71 | + })); |
| 72 | +} |
| 73 | + |
| 74 | +// A bad record that arrives together with data is reported after the data. |
| 75 | +{ |
| 76 | + // Small enough to arrive in one read and to fit into one batch. |
| 77 | + const data = payload.subarray(0, 8 * RECORD_SIZE); |
| 78 | + const server = tls.createServer(serverOptions, common.mustCall((socket) => { |
| 79 | + socket.once('data', common.mustCall(() => { |
| 80 | + assert(socket.setMaxSendFragment(RECORD_SIZE)); |
| 81 | + socket.end(data); |
| 82 | + })); |
| 83 | + })); |
| 84 | + server.listen(0, common.mustCall(() => { |
| 85 | + // Passes the handshake through, then holds the response until the server |
| 86 | + // ends and forwards it in one write, with the last data record (the one |
| 87 | + // before close_notify) corrupted. |
| 88 | + let holding = false; |
| 89 | + const held = []; |
| 90 | + const proxy = net.createServer(common.mustCall((socket) => { |
| 91 | + const upstream = net.connect(server.address().port); |
| 92 | + socket.pipe(upstream); |
| 93 | + socket.on('error', () => {}); |
| 94 | + upstream.on('data', (chunk) => { |
| 95 | + if (holding) |
| 96 | + held.push(chunk); |
| 97 | + else |
| 98 | + socket.write(chunk); |
| 99 | + }); |
| 100 | + upstream.on('end', common.mustCall(() => { |
| 101 | + const response = Buffer.concat(held); |
| 102 | + let closeNotify = 0; |
| 103 | + for (let i = 0; i < response.length; i += 5 + response.readUInt16BE(i + 3)) |
| 104 | + closeNotify = i; |
| 105 | + response[closeNotify - 1] ^= 1; |
| 106 | + socket.end(response); |
| 107 | + })); |
| 108 | + })); |
| 109 | + proxy.listen(0, common.mustCall(() => { |
| 110 | + const chunks = []; |
| 111 | + const client = tls.connect({ |
| 112 | + ...clientOptions, |
| 113 | + port: proxy.address().port, |
| 114 | + }, common.mustCall(() => { |
| 115 | + holding = true; |
| 116 | + client.write('go'); |
| 117 | + })); |
| 118 | + client.on('data', (chunk) => chunks.push(chunk)); |
| 119 | + client.on('error', common.mustCall((err) => { |
| 120 | + assert.strictEqual(err.code, isBoringSSL ? |
| 121 | + 'ERR_SSL_BAD_DECRYPT' : |
| 122 | + 'ERR_SSL_DECRYPTION_FAILED_OR_BAD_RECORD_MAC'); |
| 123 | + assert.deepStrictEqual(Buffer.concat(chunks), |
| 124 | + data.subarray(0, -RECORD_SIZE)); |
| 125 | + proxy.close(); |
| 126 | + server.close(); |
| 127 | + })); |
| 128 | + })); |
| 129 | + })); |
| 130 | +} |
0 commit comments