Repository navigation
autoSelectFamily: true breaks TLS #46679
Description
Version
v19.6.0
Platform
x64 macOS 13.2.1; x64 Ubuntu 22.04
Subsystem
tls
What steps will reproduce the bug?
const socket = tls.connect({ host: 'google.com', port: 443, servername: 'google.com', autoSelectFamily: true });
socket.on('secureConnect', () => (console.log('secure connect'), socket.end()))Results in Error: self-signed certificate with autoSelectFamily: true, works with autoSelectFamily: false.
How often does it reproduce? Is there a required condition?
Consistently.
What is the expected behavior?
Same as autoSelectFamily: false / same as when specifying IP addresses directly (with servername set).
What do you see instead?
TLS certificate validation errors.
Additional information
No response
Activity
targos commentedon Feb 16, 2023
Also note that specifying
family: 4orfamily: 6both work without error.bnoordhuis commentedon Feb 17, 2023
With
{ autoSelectFamily: true },SSL_get_servername(TLSEXT_NAMETYPE_host_name)returns NULL.That is, openssl thinks there's no SNI record and therefore this line returns
falseinstead of'google.com':node/lib/_tls_wrap.js
Line 947 in a2bbe5f
I noticed
TLSSocket.prototype._init()gets called when autoSelectFamily is set. There's also an extra call toSocket.prototype._read()that wasn't there before. This block seems responsible.node/lib/net.js
Lines 1547 to 1550 in a2bbe5f
I suspect this line (possibly other init stuff as well) needs to be reapplied in
TLSSocket.prototype._init(), otherwise node "forgets" relevant TLS context state:node/lib/_tls_wrap.js
Line 1687 in a2bbe5f
An interesting question is if
{ autoSelectFamily: true, secureContext: context }works and if not, what to do about it.mcollina commentedon Feb 18, 2023
cc @ShogunPanda
ShogunPanda commentedon Feb 18, 2023
Thanks! I'll take a look on Mon when I'll tackle all related problems forever.
ShogunPanda commentedon Feb 21, 2023
I found the issue. This will be fixed once #46587 is merged.