430f89eb8d
On the client, add verifyPeer: 'auto', 'strict', and 'manual' modes. The 'strict' mode will reject invalid certs at the handshake layer, while the 'manual' mode allows the application to inspect the peer cert and decide whether to trust it or not. The 'auto' mode is the default and will reject invalid certs at a middle layer after the onhandshake event. Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode/Opus 4.6 PR-URL: https://github.com/nodejs/node/pull/63483 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
49 lines
1.6 KiB
JavaScript
49 lines
1.6 KiB
JavaScript
// Flags: --experimental-quic --no-warnings
|
|
|
|
import { hasQuic, skip, mustCall } from '../common/index.mjs';
|
|
import assert from 'node:assert';
|
|
import * as fixtures from '../common/fixtures.mjs';
|
|
|
|
const { ok, strictEqual } = assert;
|
|
const { readKey } = fixtures;
|
|
|
|
if (!hasQuic) {
|
|
skip('QUIC is not enabled');
|
|
}
|
|
|
|
const { listen, connect } = await import('node:quic');
|
|
const { createPrivateKey } = await import('node:crypto');
|
|
|
|
// Use two different keys/certs for the default and SNI host.
|
|
const defaultKey = createPrivateKey(readKey('agent1-key.pem'));
|
|
const defaultCert = readKey('agent1-cert.pem');
|
|
const sniKey = createPrivateKey(readKey('agent2-key.pem'));
|
|
const sniCert = readKey('agent2-cert.pem');
|
|
|
|
// Server with SNI: default ('*') uses agent1, 'localhost' uses agent2.
|
|
const serverEndpoint = await listen(mustCall(async (serverSession) => {
|
|
const info = await serverSession.opened;
|
|
// The server should see the client's requested servername.
|
|
strictEqual(info.servername, 'localhost');
|
|
await serverSession.close();
|
|
}), {
|
|
sni: {
|
|
'*': { keys: [defaultKey], certs: [defaultCert] },
|
|
'localhost': { keys: [sniKey], certs: [sniCert] },
|
|
},
|
|
alpn: ['quic-test'],
|
|
});
|
|
|
|
ok(serverEndpoint.address !== undefined);
|
|
|
|
// Client connects with servername 'localhost' — should match the SNI entry.
|
|
const clientSession = await connect(serverEndpoint.address, {
|
|
servername: 'localhost',
|
|
verifyPeer: 'manual',
|
|
alpn: 'quic-test',
|
|
});
|
|
const clientInfo = await clientSession.opened;
|
|
strictEqual(clientInfo.servername, 'localhost');
|
|
|
|
await clientSession.close();
|
|
await serverEndpoint.close();
|