OpenSSL engine support in TLS module

[burmisov]

It is possible to set a custom openssl engine via crypto.setEngine and it seems to work OK. When I plug in a GOST engine, I get the GOST ciphers in crypto.getCiphers().
But it seems to have no effect on the TLS module.
Is it somehow possible to support a pluggable openssl engine for a TLS connection?

[bnoordhuis]

Is your question whether openssl supports the GOST TLS cipher suites? I believe the answer is 'yes' but you need to configure it through the 'ciphers' option to tls.createServer(). See the man page for details.

[burmisov]

Hey @bnoordhuis, thanks for a quick reply.
Yes I know GOST is supported and I can successfully use openssl cli to make the connection, but it fails in node.js. GOST ciphers require a custom openssl engine though, which I can correctly use in crypto module after crypto.setEngine(), but not in tls module.
Actually I use tls.connect() at the moment, not tls.createServer(), just to be specific.
Whet I try to specify a correct cipher suite (namely, 'GOST2001-GOST89-GOST89'), which works fine in openssl cli, this is thrown from node:

Error: 140026998658944:error:140830B5:SSL routines:ssl3_client_hello:no ciphers available:../deps/openssl/openssl/ssl/s3_clnt.c:832:

and there are really no such cipher suite in the tls.getCiphers() response.

[mscdex]

There are no ciphers listed in tls.getCiphers() at all or just not that particular one?

[burmisov]

Just not that particular one, only the usual stuff. Note that I limit ciphers in the tls.connect() to this only one, to force this error. Otherwise the connection continues but multiple other issues arise, 'cause server supports this cipher only.

Sorry I am not familiar that good with the node architecture, but can someone tell me if running crypto.setEngine() should have any influence on the tls module, on the cipher list particularly, by design?

[temaivanoff]

The same problem and the solution I described in Pull Request, see #5739

[stefanmb]

This issue is now resolved as part of #6374.