Write EPROTO error on Node 8 and above

[dogancelik]

I'm getting EPROTO errors on Node 8 and above

Test code test.js

var https = require('https');
var fs = require('fs');

console.log('Node', process.version);

var writeStream = fs.createWriteStream('test.html');
writeStream.on('finish', function () {
  console.log('Finish');
})

https.get('https://handbrake.fr/nightly.php', function (res) {
  res.pipe(writeStream);
});

Test by version

v4

$ node test.js
Node v4.8.7
Finish

v5

$ node test.js
Node v5.12.0
Finish

v6

$ node test.js
Node v6.13.1
Finish

v7

$ node test.js
Node v7.10.1
Finish

v8

$ node test.js
Node v8.10.0
events.js:183
      throw er; // Unhandled 'error' event
      ^

Error: write EPROTO 101057795:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:openssl\ssl\s23_clnt.c:802:

    at _errnoException (util.js:1022:11)
    at WriteWrap.afterWrite [as oncomplete] (net.js:880:14)

v9

$ node test.js
Node v9.8.0
events.js:165
      throw er; // Unhandled 'error' event
      ^

Error: write EPROTO 101057795:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:openssl\ssl\s23_clnt.c:802:

    at WriteWrap.afterWrite [as oncomplete] (net.js:841:14)
Emitted 'error' event at:
    at TLSSocket.socketErrorListener (_http_client.js:394:9)
    at TLSSocket.emit (events.js:180:13)
    at onwriteError (_stream_writable.js:427:12)
    at onwrite (_stream_writable.js:449:5)
    at _destroy (internal/streams/destroy.js:39:7)
    at TLSSocket.Socket._destroy (net.js:545:3)
    at TLSSocket.destroy (internal/streams/destroy.js:32:8)
    at WriteWrap.afterWrite [as oncomplete] (net.js:843:10)

---

Version: 4-9 (arch. 64-bit) (listed in console log above)
Platform: Windows 10 (64-bit)

[dogancelik]

Note: handbrake.fr has A+ grade SSL (ref)

[addaleax]

Looks like this was introduced somewhere between v8.5.0 and v8.6.0.

Also, this doesn’t appear to reproduce on master for me?

[dogancelik]

@addaleax Yeah it works in v10

$ node-nightly test.js
Node v10.0.0-nightly20180314040dd244de
Finish

[mscdex]

git bisect points to: #15206

/cc @rogaps @jasnell @bnoordhuis @tniessen

[addaleax]

And reverse git bisect says that the fix for this on master is af78840 (#16853), which was labelled semver-major.

I am not sure in what way that is actually a breaking change.

[jasnell]

The semver label on the fix can be reduced. I think it was purely defensive...

…

On Mar 14, 2018 17:47, "Anna Henningsen" ***@***.***> wrote: And reverse git bisect says that the fix for this on master is af78840 <af78840> (#16853 <#16853>), which was labelled semver-major. I am not sure in what way that is actually a breaking change. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#19359 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAa2ef4B_zn0sV1gIS0jpKRArkqoQABzks5teY_bgaJpZM4SrLds> .

[rogaps]

This happens because of mismatched ecdhCurves. Before the fix, node uses prime256v1 as default. This is the related issue #16196

[bnoordhuis]

I'll close this out because it's essentially a duplicate of #16196 but thank you for writing up a good bug report. If anyone has ideas on what direction to take, please chime in on that issue.

[harishmahajan]

I try this.

NODE_TLS_REJECT_UNAUTHORIZED=0 yarn install

and my issue is solved.

[bnoordhuis]

No, you just swapped one issue for another. NODE_TLS_REJECT_UNAUTHORIZED=0 turns off TLS certificate validation; it's no better than unencrypted HTTP in terms of security.