Only add @SECLEVEL=0 where the TLS backend supports it

src/rules/passthrough-handling.ts

@@ -16,7 +16,7 @@ import { asBuffer } from '../util/buffer-utils';
 import { isIP, isLocalhostAddress, normalizeIP } from '../util/ip-utils';
 import { CachedDns, dnsLookup, DnsLookupFunction } from '../util/dns';
 import { isMockttpBody, encodeBodyBuffer } from '../util/request-utils';
-import { areFFDHECurvesSupported } from '../util/openssl-compat';
+import { areFFDHECurvesSupported, isSecLevelSupported } from '../util/openssl-compat';
 import { findRawHeaderIndex, getHeaderValue } from '../util/header-utils';
 import { getDefaultPort } from '../util/url';
 import { TlsMetadata, TlsClientHello } from '../util/socket-extensions';
@@ -178,8 +178,9 @@ export function getUpstreamTlsOptions({
             'AES256-SHA',
 
             // This magic cipher is the very obtuse way that OpenSSL downgrades the overall
-            // security level to allow various legacy settings, protocols & ciphers:
-            ...(!strictHttpsChecks
+            // security level to allow various legacy settings, protocols & ciphers. It's
+            // OpenSSL-only though - other backends reject the whole cipher string:
+            ...(!strictHttpsChecks && isSecLevelSupported()
                 ? ['@SECLEVEL=0']
                 : []
             )

src/util/openssl-compat.ts

@@ -1,3 +1,4 @@
+import * as tls from 'tls';
 import * as semver from 'semver';
 
 export function areFFDHECurvesSupported(opensslVersion: string | undefined) {
@@ -23,4 +24,24 @@ export function areFFDHECurvesSupported(opensslVersion: string | undefined) {
         // we assume that the curves are not supported for safety
         return false;
     }
-}
+}
+
+let secLevelSupport: boolean | undefined;
+
+export function isSecLevelSupported() {
+    // The @SECLEVEL cipher-string directive is an OpenSSL extension. Backends that
+    // don't implement it (e.g. BoringSSL) reject the entire cipher string with
+    // ERR_SSL_INVALID_COMMAND, rather than ignoring the unknown directive.
+
+    // Feature-detected, not derived from process.versions.openssl, because that
+    // isn't reliable: Bun reports '1.1.0', a version that does support @SECLEVEL.
+    if (secLevelSupport === undefined) {
+        try {
+            tls.createSecureContext({ ciphers: 'AES128-SHA:@SECLEVEL=0' });
+            secLevelSupport = true;
+        } catch (e) {
+            secLevelSupport = false;
+        }
+    }
+    return secLevelSupport;
+}

test/openssl-compat.spec.ts

@@ -1,5 +1,7 @@
 import { expect } from 'chai';
-import { areFFDHECurvesSupported } from '../src/util/openssl-compat';
+import * as tls from 'tls';
+
+import { areFFDHECurvesSupported, isSecLevelSupported } from '../src/util/openssl-compat';
 
 describe('areFFDHECurvesSupported', () => {
     it('True only for 3+ versions', () => {
@@ -22,3 +24,23 @@ describe('areFFDHECurvesSupported', () => {
         expect(areFFDHECurvesSupported(undefined)).to.be.false;
     });
 });
+
+describe('isSecLevelSupported', () => {
+    it('Matches whether the TLS backend actually accepts the directive', () => {
+        // Detected rather than hardcoded, since this suite runs on runtimes with
+        // different TLS backends. The point is that the helper agrees with reality.
+        let accepted: boolean;
+        try {
+            tls.createSecureContext({ ciphers: 'AES128-SHA:@SECLEVEL=0' });
+            accepted = true;
+        } catch (e) {
+            accepted = false;
+        }
+
+        expect(isSecLevelSupported()).to.equal(accepted);
+    });
+
+    it('Is stable across calls', () => {
+        expect(isSecLevelSupported()).to.equal(isSecLevelSupported());
+    });
+});