Nodejs

	Nodejs Network Programming				Site written by John Middlemas

Search CopyCode

Google Bing Yahoo Archive

Wikipedia Compute Question

Twitter Flickr CanUse BBC

Homepage

Back
Page Index A to Z

Main Pages

Original Posting
Original Site
Newsgroup Post
Web 3
Wrong Approach
XML

Reference

Network Programming - The main goal of webneurons is to develop a better way of programming computers. Demonstration of a simple webneurons network. Also includes a minimal javascript XML parser of 37 lines.

Nodejs. An issue with the node js server I reported regarding client certificates and the requestCert option not working with Chrome and Firefox

With the below code you can see a lot of what is going on when a node https server asks for a certificate from the client browser. I ran my tests on localhost, XP pro sp3 with node.exe 0.5.4 serving FF5, Chrome12, IE8, and Opera 11.5.

All the possible server and socket events cause printout to the console allowing a view of the client server negotiations.

What the tests suggest is that something quite bad is going on with node if requestCert is set true in the options object. With Firefox and Chrome a first client request is handled ok but subsequent requests fail to reach node because of socket problem(s) caused by node I believe.

The test results are below the code. Free server key and cert, and client cert were used from startSSL.com (startCom Ltd) which is an approved root CA in all the browsers tested.

serverEvents.js
---------------

var  https = require('https'),
        fs = require('fs')

var options = {
    requestCert: true,
    key: fs.readFileSync('serverKey.pem'),
    cert: fs.readFileSync('serverCert.pem')
};

var server = https.createServer(options, function (req, res) {
    var reply = 'OK'
    res.writeHead( 200, {
        'Content-Type': 'text/html',
        'Content-length': reply.length,
        'Connection': 'close'
    })
    res.write(reply)
    res.end()
})

server.on('request', function(req, res) {
    console.log("REQUEST")
})

server.on('connection', function(socket) {
    console.log("\nSOCKET")
    socket.on("connect", function(){console.log("connect")})
    socket.on("data",    function(data){console.log("data")})
    socket.on("end",     function(){console.log("end")})
    socket.on("timeout", function(){console.log("timeout")})
    socket.on("drain",   function(){console.log("drain")})
    socket.on("error",   function(ex){console.log("error: ", ex)})
    socket.on("close",   function(had_error){console.log("close: ", had_error)})
})

server.on('close', function(errno) {
    console.log("CLOSE: ", errno)
})

server.on('checkContinue', function(req, res) {
    console.log("CHECK_CONTINUE")
})

server.on('upgrade', function(request, socket, head) {
    console.log("UPGRADE");
})

server.on('clientError', function(ex) {
    console.log("EXCEPTION: ", ex);
})

server.listen(443, function() {
    console.log('Secure server running on port 443')
})

What I did for each browser:  
Console:  node serverEvents.js (start https server)
Client:  request https://localhost, accept all security and certificate prompts and finally see 'OK' in the browser window. Restart console serverEvents.js
Take results from here.
Client:  first request to https://localhost. Shows 'OK' in all browsers
Client:  second request to http://localhost (reload browser). 'OK' in IE8 and Opera, but errors in Chrome and Firefox

Results:
--------

Chrome 12 console output (my comments in brackets):
---------------------------------------------------

C:\Nodejs>node serverEvents.js
Secure server running on port 443

SOCKET
connect

SOCKET
connect
data
data
drain
drain
end
close:  false
end
close:  false

SOCKET
connect
data
drain
end
close:  false

SOCKET
connect
data
drain
data
end

SOCKET
connect
drain
close:  false
data
drain
data
drain
REQUEST        (First request comes through allright)
data
end
drain
close:  false

SOCKET
connect
data
close:  false

(end of first request)

SOCKET
connect

SOCKET
connect
data
close:  false
data
close:  false

SOCKET
connect
data
close:  false

(No second request ever gets to the server)

On the second request Chrome gives the following error message which is the same as noted by gasteve in the related issue at https://github.com/joyent/node/issues/1494.

"SSL connection error
Unable to make a secure connection to the server. This may be a problem with the server, or it may be requiring a client authentication certificate that you don't have.
Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error."

Why are there so many socket events? Further analysis with the Wireshark network protocol analyser suggests that node ignores the (Wireshark defined) SSL type client hello's that Chrome issues and only gives server hello's to SSLv2 and TLSv1.0 type client hello's. IE8 behaves much better because it adapts by issuing SSLv2 type if SSL type gets no response.

IE8 console output (my comments in brackets)
--------------------------------------------

C:\Nodejs>node serverEvents.js
Secure server running on port 443

SOCKET        
connect
data
drain
data
drain
REQUEST       (First https request received ok)
data
close:  false

SOCKET          (IE8 SSL type client hello ignored by node for this socket event)
connect
data
close:  false

SOCKET      (IE8 issues SSLv2 type client hello accepted by node, so this request works)
connect
data
drain
data
drain
REQUEST    (second https request fine  and 'OK' appears in browser)
data
close:  false

IE8 works nicely because it adapts. This doesn't let node off the hook though. Maybe node should accept SSL type client hello's.

Firefox 5 console output:
-------------------------

C:\Nodejs>node serverEvents.js
Secure server running on port 443

SOCKET  (FF issues TLSv1.0 client hello here and node replies with server hello)
connect
data
drain
data
drain
REQUEST
data
end
drain
close:  false

(end of first https request, all ok so far)

SOCKET        (FF issues SSL client hello, node does not reply with server hello)
connect
data
close:  false

SOCKET       (FF repeats SSL client hello)
connect
data
close:  false

SOCKET    (etc, etc)
connect
data
close:  false

SOCKET
connect
data
close:  false

(second https request never reaches node)

(FF gives up and issues the following error)

The connection was reset
The connection to the server was reset while the page was loading.
The site could be temporarily unavailable or too busy. Try again in a few moments.
If you are unable to load any pages, check your computer's network connection.
If your computer or network is protected by a firewall or proxy, make sure that Firefox is permitted to access the Web.

Opera 11.5 console output:
--------------------------

C:\Nodejs>node serverEvents.js
Secure server running on port 443

SOCKET
connect
data
drain
data
data
drain
REQUEST       (First https request OK)
data
close:  false

SOCKET
connect
data
close:  false

SOCKET
connect
data
drain
data
data
drain
REQUEST    (Opera always asks for favicon.ico as well with every request)
data
close:  false

(end of first https request)

SOCKET
connect
data
close:  false

SOCKET
connect
data
drain
data
data
drain
REQUEST
data
close:  false

SOCKET
connect
data
close:  false

SOCKET
connect
data
drain
data
drain
REQUEST
data
close:  false

(second https request completes OK)

Conclusions
-----------

Please note that the above Chrome and Firefox errors do not occur if requestCert is not set true in the options object.

Node is not therefore usable with Firefox or Chrome when requestCert is true. This appears to be a major flaw. Effectively the use of client certificate authentication with node is impractical if two major browsers fail.

Wireshark protocol analysis suggests the root problem is that node does not give server hello's for all types of client hello, in particular the 'SSL' type defined and reported by wireshark. SSLv2 and TLSv1.0 types are accepted. The above event analysis shows that something is very wrong indeed.

Github node issue 1516 - github.com node

Site structure created by John Middlemas Site written by John Middlemas