tls.Server() ignores user-supplied cipher list

[markcohen]

v0.6.0 - Windows - x86 - VS2010

[v0.6.0 tls.js line 859] sets the ssl_ctx cipher list to RC4-SHA:AES128-SHA:AES256-SHA

This has at least 2 side effects:

1. It overrides any user-supplied cipher list in the high-level createServer() functions
2. It causes HTTPS/TLS servers initiated with ECC or DH keys to silently barf on the SSL handshake, leaving users with the no-fun job of debugging the SSL protocol :)

[bnoordhuis]

Thanks for the report, Mark. Quick sanity check, can you check if this patch works for you?

diff --git a/lib/tls.js b/lib/tls.js
index 21bb2af..8f83ecf 100644
--- a/lib/tls.js
+++ b/lib/tls.js
@@ -849,15 +849,13 @@ function Server(/* [options], listener */) {
     passphrase: self.passphrase,
     cert: self.cert,
     ca: self.ca,
-    ciphers: self.ciphers,
+    ciphers: self.ciphers || 'RC4-SHA:AES128-SHA:AES256-SHA',
     secureProtocol: self.secureProtocol,
     secureOptions: self.secureOptions,
     crl: self.crl,
     sessionIdContext: self.sessionIdContext
   });

-  sharedCreds.context.setCiphers('RC4-SHA:AES128-SHA:AES256-SHA');
-
   // constructor call
   net.Server.call(this, function(socket) {
     var creds = crypto.createCredentials(null, sharedCreds.context);
@@ -1017,7 +1015,6 @@ exports.connect = function(port /* host, options, cb */) {
   var socket = new net.Stream();

   var sslcontext = crypto.createCredentials(options);
-  //sslcontext.context.setCiphers('RC4-SHA:AES128-SHA:AES256-SHA');

   convertNPNProtocols(options.NPNProtocols, this);
   var pair = new SecurePair(sslcontext, false, true, false,

[markcohen]

Yep, works great. Thanks.

[bnoordhuis]

Thanks for testing. Merged in 5e3b009.

[bminer]

There is still no documentation on the 'ciphers' option. :) Could someone please add this?

[bnoordhuis]

Documentation added in 38eec57.