Bug 1910749

Problem doesn't manifest itself if using stock node from https://nodejs.org/dist/v12.19.1/node-v12.19.1-linux-x64.tar.xz

The below code works on 12.18.2 but not 12.19.1

#!/usr/bin/node 

const fs = require('fs')

require('tls')
.createServer(
        // options
        {

                key: fs.readFileSync('test.key'),
                cert: fs.readFileSync('test.cer'),
                ca: [ fs.readFileSync('root.cer') ],
//                ciphers: 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256',
        }, 
        // handler
        (socket) => socket.write('HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK\r\n')
)
.listen(8433, () => { console.log(`listening on ${8433}`) })

The above code has the "cipher" line commented out, but if you uncomment that and run on 12.19.1, this will replicate the problem.

Created attachment 1760390 [details]
minimal fix

After investigation, this issue first manifested in v12.18.4, which conincides with a OpenSSL patch refactoring effort. During the refactor, a part of the patch was missed which was necessary to properly setup ECDHE negotiation with OpenSSL 1.0.* – see the patch for the missing part.

The fix was tested with the provided reproducer – thanks a lot for it!

Since the same refactored patches are used in rh-nodejs14, it stands to reason it is broken there as well. I will investigate further and clone this appropriately.

Patch imported to dist-git: http://pkgs.devel.redhat.com/cgit/rpms/nodejs/commit/?h=rhscl-3.7-rh-nodejs12-rhel-7&id=14697ab6e49f9e8c1289f502f7972ffbd5fc521d

After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.

The release with a fix is currently being worked on. Re-opening.

NEW PASS:
version:
rh-nodejs12-nodejs-12.21.0-1.el7.x86_64

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 06:44:35 ] :: [  BEGIN   ] :: Running reproducer :: actually running 'node server.js &> server.log &'
:: [ 06:44:35 ] :: [   PASS   ] :: Running reproducer (Expected 0, got 0)
:: [ 06:44:35 ] :: [   LOG    ] :: Reporoducer is running on PID=14875
:: [ 06:44:36 ] :: [  BEGIN   ] :: Running 'curl -k https://localhost:8433 &> curl.log'
:: [ 06:44:36 ] :: [   PASS   ] :: Command 'curl -k https://localhost:8433 &> curl.log' (Expected 0, got 0)
:: [ 06:44:36 ] :: [  BEGIN   ] :: Running 'kill 14875'
/usr/share/beakerlib/testing.sh: řádek 756: 14875 Ukončen (SIGTERM)      node server.js &>server.log
:: [ 06:44:36 ] :: [   PASS   ] :: Command 'kill 14875' (Expected 0, got 0)
:: [ 06:44:36 ] :: [   PASS   ] :: File 'server.log' should contain 'listening on 8433' 
--------server.log:------
listening on 8433
--------\server.log------
:: [ 06:44:36 ] :: [   PASS   ] :: File 'curl.log' should contain 'OK' 
:: [ 06:44:36 ] :: [   PASS   ] :: File 'curl.log' should not contain 'curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).' 
--------curl.log:------
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100     2  100     2    0     0     18      0 --:--:-- --:--:-- --:--:--    18
OK--------\curl.log------
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Duration: 1s
::   Assertions: 6 good, 0 bad
::   RESULT: PASS (Test)


Old FAIL:
version:
rh-nodejs12-nodejs-12.19.1-2.el7.x86_64

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 06:44:34 ] :: [  BEGIN   ] :: Running reproducer :: actually running 'node server.js &> server.log &'
:: [ 06:44:34 ] :: [   PASS   ] :: Running reproducer (Expected 0, got 0)
:: [ 06:44:34 ] :: [   LOG    ] :: Reporoducer is running on PID=12445
:: [ 06:44:35 ] :: [  BEGIN   ] :: Running 'curl -k https://localhost:8433 &> curl.log'
:: [ 06:44:36 ] :: [   FAIL   ] :: Command 'curl -k https://localhost:8433 &> curl.log' (Expected 0, got 35)
:: [ 06:44:36 ] :: [  BEGIN   ] :: Running 'kill 12445'
/usr/share/beakerlib/testing.sh: řádek 756: 12445 Ukončen (SIGTERM)      node server.js &>server.log
:: [ 06:44:36 ] :: [   PASS   ] :: Command 'kill 12445' (Expected 0, got 0)
:: [ 06:44:36 ] :: [   PASS   ] :: File 'server.log' should contain 'listening on 8433' 
--------server.log:------
listening on 8433
--------\server.log------
:: [ 06:44:36 ] :: [   FAIL   ] :: File 'curl.log' should contain 'OK' 
:: [ 06:44:36 ] :: [   FAIL   ] :: File 'curl.log' should not contain 'curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).' 
--------curl.log:------
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).
--------\curl.log------
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Duration: 2s
::   Assertions: 3 good, 3 bad
::   RESULT: FAIL (Test)

The z-stream errata should now be shipped. Switching this y-stream tracker ON_QA for verification.

In accordance with the Red Hat Software Collections Product Life Cycle, the support period for this collection has ended.

New bug fix, enhancement, and security errata updates, as well as technical support services will no longer be made available for this collection.

Customers are encouraged to upgrade to a later release.

Please contact Red Hat Support if you have further questions, or refer to the support lifecycle page for more information. https://access.redhat.com/support/policy/updates/rhscl/