http: `servername === false` should disable SNI #27316

indutny · 2019-04-19T21:17:01Z

There is no way to disable SNI extension when sending a request to HTTPS
server. Setting options.servername to a falsy value would make Node.js
core override it with either hostname or ip address.

This change introduces a way to disable SNI completely if this is
required for user's application. Setting options.servername to false
in https.request would disable overrides and thus disable the
extension.

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
documentation is changed or added
commit message follows commit guidelines

There is no way to disable SNI extension when sending a request to HTTPS server. Setting `options.servername` to a falsy value would make Node.js core override it with either hostname or ip address. This change introduces a way to disable SNI completely if this is required for user's application. Setting `options.servername` to `false` in `https.request` would disable overrides and thus disable the extension.

nodejs-github-bot · 2019-04-19T21:17:03Z

Lite-CI: https://ci.nodejs.org/job/node-test-pull-request-lite-pipeline/3308

indutny · 2019-04-19T21:17:20Z

cc @nodejs/http @nodejs/crypto

srl295

LGTM. (though I did not have this use case, it is plausible and would have simplified my testing)

test/parallel/test-https-agent-sni.js

doc/api/https.md

indutny · 2019-04-20T16:49:04Z

Thank you for review everyone!

doc/api/https.md

test/parallel/test-https-agent-sni.js

apapirovski

LGTM but one nit re: documentation.

apapirovski · 2019-04-21T19:14:37Z

doc/api/https.md

@@ -29,6 +29,10 @@ An [`Agent`][] object for HTTPS similar to [`http.Agent`][]. See
  Can have the same fields as for [`http.Agent(options)`][], and
  * `maxCachedSessions` {number} maximum number of TLS cached sessions.
    Use `0` to disable TLS session caching. **Default:** `100`.
+  * `servername` {string | boolean} the value of


Boolean might be slightly misleading? It's really {string | false} since setting it to true won't do what one might expect...

Beware that false will be the only type case here and will baffle doc tools (tools/doc/type-parser.js will throw).

That was exactly my reasoning. We might want to use null as @bnoordhuis has suggested to fix this!

bnoordhuis

LGTM % nits others pointed out.

Observation: I don't think you can conclude from the test that no SNI extension is sent, just that the user's code doesn't set it explicitly. Maybe add a { SNICallback: cb } to the server's options object to verify?

Question: isn't null a better value than false for the opt-out when true doesn't work?

indutny · 2019-04-23T16:57:02Z

@bnoordhuis I think the test verifies it very well. The socket.servername is set to false only when there is no SNI present, AFAIK!

Is there a common practice for falsey values that we try to follow in core? In this PR's case - there are three possible types of values undefined, string, or null/false.

@vsemozhetbyt @apapirovski @srl295 @lpinca @BridgeAR may I ask y'all for an opinion on the topic?

BridgeAR · 2019-04-23T17:40:47Z

@indutny

Is there a common practice for falsey values that we try to follow in core

Not that I am aware of. Using undefined seems a bad option, since it's often handled as not existing. So a property with undefined as value would be considered not set. Using an empty string in this specific case might be an alternative but AFAIC only if there's no valid use case for that so far.

Using null is somewhat ambiguous in core. It's often ignored while we mostly become stricter with type checks and often do not accept null as alternative to undefined anymore. In this specific case I would consider it a good option to indicate the wish to disable the functionality.

I can not think of any API that only accepts false but not true, so that would be something new in core.

Thus, I personally would go with either an empty string or null while not blocking false.

sam-github · 2019-04-23T17:58:32Z

I agree that an empty string and/or null would be better than false.

https://tools.ietf.org/html/rfc6066#section-3 doesn't allow zero-length server names, so an empty string is not a valid value, and attempting to set one will error with SSL_R_SSL3_EXT_INVALID_SERVERNAME if a string of length zero is passed to SSL_set_tlsext_host_name().

indutny · 2019-04-27T16:18:16Z

Alright, updated the PR to use '' instead of false. PTAL @nodejs/collaborators

nodejs-github-bot · 2019-04-27T16:26:14Z

CI: https://ci.nodejs.org/job/node-test-pull-request/22749/

nodejs-github-bot · 2019-04-29T02:38:36Z

CI: https://ci.nodejs.org/job/node-test-pull-request/22797/ ✅

There is no way to disable SNI extension when sending a request to HTTPS server. Setting `options.servername` to a falsy value would make Node.js core override it with either hostname or ip address. This change introduces a way to disable SNI completely if this is required for user's application. Setting `options.servername` to `` in `https.request` would disable overrides and thus disable the extension. PR-URL: nodejs#27316 Reviewed-By: Steven R Loomis <srloomis@us.ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Anatoli Papirovski <apapirovski@mac.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

Trott · 2019-04-30T13:44:39Z

Landed in 98e9de7

There is no way to disable SNI extension when sending a request to HTTPS server. Setting `options.servername` to a falsy value would make Node.js core override it with either hostname or ip address. This change introduces a way to disable SNI completely if this is required for user's application. Setting `options.servername` to `` in `https.request` would disable overrides and thus disable the extension. PR-URL: #27316 Reviewed-By: Steven R Loomis <srloomis@us.ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Anatoli Papirovski <apapirovski@mac.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

indutny added 2 commits April 19, 2019 17:11

doc: add description of servername

549b4bd

nodejs-github-bot added the http Issues or PRs related to the http subsystem. label Apr 19, 2019

srl295 approved these changes Apr 19, 2019

View reviewed changes

vsemozhetbyt reviewed Apr 20, 2019

View reviewed changes

test/parallel/test-https-agent-sni.js Outdated Show resolved Hide resolved

vsemozhetbyt reviewed Apr 20, 2019

View reviewed changes

doc/api/https.md Outdated Show resolved Hide resolved

doc/api/https.md Outdated Show resolved Hide resolved

lpinca approved these changes Apr 20, 2019

View reviewed changes

fix

2ea3e4c

BridgeAR added the semver-minor PRs that contain new features and should be released in the next minor version. label Apr 21, 2019

BridgeAR approved these changes Apr 21, 2019

View reviewed changes

doc/api/https.md Outdated Show resolved Hide resolved

test/parallel/test-https-agent-sni.js Show resolved Hide resolved

apapirovski approved these changes Apr 21, 2019

View reviewed changes

bnoordhuis approved these changes Apr 22, 2019

View reviewed changes

indutny added 2 commits April 27, 2019 16:52

https: fix link

c85a7eb

change false => ''

1abce92

indutny force-pushed the feature/disable-sni branch from 593faf5 to 1abce92 Compare April 27, 2019 16:17

BridgeAR approved these changes Apr 27, 2019

View reviewed changes

BridgeAR added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Apr 27, 2019

Trott approved these changes Apr 27, 2019

View reviewed changes

sam-github approved these changes Apr 29, 2019

View reviewed changes

trivikr approved these changes Apr 30, 2019

View reviewed changes

Trott closed this Apr 30, 2019

targos mentioned this pull request May 6, 2019

v12.2.0 proposal #27578

Merged

BethGriggs added the dont-land-on-v10.x label Aug 20, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

http: `servername === false` should disable SNI #27316

http: `servername === false` should disable SNI #27316

indutny commented Apr 19, 2019

nodejs-github-bot commented Apr 19, 2019

indutny commented Apr 19, 2019

srl295 left a comment

indutny commented Apr 20, 2019

apapirovski left a comment

apapirovski Apr 21, 2019

vsemozhetbyt Apr 21, 2019

indutny Apr 23, 2019

bnoordhuis left a comment

indutny commented Apr 23, 2019

BridgeAR commented Apr 23, 2019

sam-github commented Apr 23, 2019

indutny commented Apr 27, 2019

nodejs-github-bot commented Apr 27, 2019

nodejs-github-bot commented Apr 29, 2019 •

edited by Trott

Loading

Trott commented Apr 30, 2019

http: servername === false should disable SNI #27316

http: servername === false should disable SNI #27316

Conversation

indutny commented Apr 19, 2019

Checklist

nodejs-github-bot commented Apr 19, 2019

indutny commented Apr 19, 2019

srl295 left a comment

Choose a reason for hiding this comment

indutny commented Apr 20, 2019

apapirovski left a comment

Choose a reason for hiding this comment

apapirovski Apr 21, 2019

Choose a reason for hiding this comment

vsemozhetbyt Apr 21, 2019

Choose a reason for hiding this comment

indutny Apr 23, 2019

Choose a reason for hiding this comment

bnoordhuis left a comment

Choose a reason for hiding this comment

indutny commented Apr 23, 2019

BridgeAR commented Apr 23, 2019

sam-github commented Apr 23, 2019

indutny commented Apr 27, 2019

nodejs-github-bot commented Apr 27, 2019

nodejs-github-bot commented Apr 29, 2019 • edited by Trott Loading

Trott commented Apr 30, 2019

http: `servername === false` should disable SNI #27316

http: `servername === false` should disable SNI #27316

nodejs-github-bot commented Apr 29, 2019 •

edited by Trott

Loading