From b9a5922c36d77d1c6bb90fdc5225b5c838e5aa39 Mon Sep 17 00:00:00 2001

From: Zuzana Svetlikova <zsvetlik@redhat.com>

Date: Wed, 19 Feb 2020 10:31:43 +0000

Subject: [PATCH 3/4] fix failing tests

---

 doc/api/cli.md                                     |   5 +-

 test/doctool/test-make-doc.js                      |  63 ------

 test/known_issues/test-crypto-aes-wrap.js          |  62 ++++++

 test/known_issues/test-crypto-des3-wrap.js         |  25 +++

 test/known_issues/test-crypto-hash-stream-pipe.js  |  46 ++++

 test/known_issues/test-make-doc.js                 |  63 ++++++

 test/known_issues/test-tls-cli-max-version-1.3.js  |  15 ++

 test/known_issues/test-tls-cli-min-max-conflict.js |  14 ++

 test/known_issues/test-tls-cli-min-version-1.3.js  |  15 ++

 .../test-tls-client-renegotiation-13.js            |  41 ++++

 test/known_issues/test-tls-keylog-tlsv13.js        |  32 +++

 test/known_issues/test-tls-no-sslv3.js             |  49 +++++

 test/known_issues/test-tls-ticket-12.js            |  12 +

 test/known_issues/test-tls-ticket-cluster.js       | 135 ++++++++++++

 test/known_issues/test-tls-ticket.js               | 159 ++++++++++++++

 test/known_issues/test-v8-serdes.js                | 244 +++++++++++++++++++++

 test/parallel/test-crypto-aes-wrap.js              |  62 ------

 test/parallel/test-crypto-authenticated.js         |  54 +----

 test/parallel/test-crypto-des3-wrap.js             |  25 ---

 test/parallel/test-crypto-hash-stream-pipe.js      |  46 ----

 test/parallel/test-crypto-hash.js                  |  81 -------

 test/parallel/test-crypto-key-objects.js           | 175 ---------------

 test/parallel/test-crypto-keygen.js                |  54 -----

 test/parallel/test-crypto-pbkdf2.js                |  18 --

 test/parallel/test-crypto-sign-verify.js           |   8 -

 test/parallel/test-crypto.js                       |   6 +-

 test/parallel/test-https-agent-session-eviction.js |  42 +++-

 test/parallel/test-tls-alert-handling.js           |   2 +-

 test/parallel/test-tls-cli-max-version-1.3.js      |  15 --

 test/parallel/test-tls-cli-min-max-conflict.js     |  14 --

 test/parallel/test-tls-cli-min-version-1.0.js      |   2 +-

 test/parallel/test-tls-cli-min-version-1.1.js      |   2 +-

 test/parallel/test-tls-cli-min-version-1.2.js      |   2 +-

 test/parallel/test-tls-cli-min-version-1.3.js      |  15 --

 .../test-tls-client-getephemeralkeyinfo.js         |   2 -

 test/parallel/test-tls-client-renegotiation-13.js  |  41 ----

 test/parallel/test-tls-destroy-stream.js           |   2 +-

 test/parallel/test-tls-getcipher.js                |  25 +--

 test/parallel/test-tls-keylog-tlsv13.js            |  32 ---

 test/parallel/test-tls-min-max-version.js          |  29 +--

 test/parallel/test-tls-multi-key.js                |   4 +-

 test/parallel/test-tls-multi-pfx.js                |   4 +-

 test/parallel/test-tls-no-sslv3.js                 |  49 -----

 test/parallel/test-tls-passphrase.js               |   2 +-

 test/parallel/test-tls-set-ciphers.js              |  27 +--

 test/parallel/test-tls-ticket-12.js                |  12 -

 test/parallel/test-tls-ticket-cluster.js           | 135 ------------

 test/parallel/test-tls-ticket.js                   | 159 --------------

 test/parallel/test-v8-serdes.js                    | 244 ---------------------

 49 files changed, 973 insertions(+), 1397 deletions(-)

 delete mode 100644 test/doctool/test-make-doc.js

 create mode 100644 test/known_issues/test-crypto-aes-wrap.js

 create mode 100644 test/known_issues/test-crypto-des3-wrap.js

 create mode 100644 test/known_issues/test-crypto-hash-stream-pipe.js

 create mode 100644 test/known_issues/test-make-doc.js

 create mode 100644 test/known_issues/test-tls-cli-max-version-1.3.js

 create mode 100644 test/known_issues/test-tls-cli-min-max-conflict.js

 create mode 100644 test/known_issues/test-tls-cli-min-version-1.3.js

 create mode 100644 test/known_issues/test-tls-client-renegotiation-13.js

 create mode 100644 test/known_issues/test-tls-keylog-tlsv13.js

 create mode 100644 test/known_issues/test-tls-no-sslv3.js

 create mode 100644 test/known_issues/test-tls-ticket-12.js

 create mode 100644 test/known_issues/test-tls-ticket-cluster.js

 create mode 100644 test/known_issues/test-tls-ticket.js

 create mode 100644 test/known_issues/test-v8-serdes.js

 delete mode 100644 test/parallel/test-crypto-aes-wrap.js

 delete mode 100644 test/parallel/test-crypto-des3-wrap.js

 delete mode 100644 test/parallel/test-crypto-hash-stream-pipe.js

 delete mode 100644 test/parallel/test-tls-cli-max-version-1.3.js

 delete mode 100644 test/parallel/test-tls-cli-min-max-conflict.js

 delete mode 100644 test/parallel/test-tls-cli-min-version-1.3.js

 delete mode 100644 test/parallel/test-tls-client-renegotiation-13.js

 delete mode 100644 test/parallel/test-tls-keylog-tlsv13.js

 delete mode 100644 test/parallel/test-tls-no-sslv3.js

 delete mode 100644 test/parallel/test-tls-ticket-12.js

 delete mode 100644 test/parallel/test-tls-ticket-cluster.js

 delete mode 100644 test/parallel/test-tls-ticket.js

 delete mode 100644 test/parallel/test-v8-serdes.js

diff --git a/doc/api/cli.md b/doc/api/cli.md

index ecf7632..15124c5 100644

--- a/doc/api/cli.md

+++ b/doc/api/cli.md

@@ -711,8 +711,7 @@ with crypto support (default).

 added: v12.0.0

 -->

-Set [`tls.DEFAULT_MAX_VERSION`][] to 'TLSv1.2'. Use to disable support for

-TLSv1.3.

+Set [`tls.DEFAULT_MAX_VERSION`][] to 'TLSv1.2'.

 ### `--tls-min-v1.0`

@@ -1094,11 +1093,9 @@ Node.js options that are allowed are:

 * `--title`

 * `--tls-cipher-list`

 * `--tls-max-v1.2`

-* `--tls-max-v1.3`

 * `--tls-min-v1.0`

 * `--tls-min-v1.1`

 * `--tls-min-v1.2`

-* `--tls-min-v1.3`

 * `--trace-deprecation`

 * `--trace-event-categories`

 * `--trace-event-file-pattern`

diff --git a/test/doctool/test-make-doc.js b/test/doctool/test-make-doc.js

deleted file mode 100644

index 7f4f3ae..0000000

--- a/test/doctool/test-make-doc.js

+++ /dev/null

@@ -1,63 +0,0 @@

-'use strict';

-const common = require('../common');

-if (common.isWindows) {

-  common.skip('`make doc` does not run on Windows');

-}

-

-// This tests that `make doc` generates the documentation properly.

-// Note that for this test to pass, `make doc` must be run first.

-

-const assert = require('assert');

-const fs = require('fs');

-const path = require('path');

-

-const apiPath = path.resolve(__dirname, '..', '..', 'out', 'doc', 'api');

-const mdPath = path.resolve(__dirname, '..', '..', 'doc', 'api');

-const allMD = fs.readdirSync(mdPath);

-const allDocs = fs.readdirSync(apiPath);

-assert.ok(allDocs.includes('index.html'));

-

-const actualDocs = allDocs.filter(

-  (name) => {

-    const extension = path.extname(name);

-    return extension === '.html' || extension === '.json';

-  }

-);

-

-for (const name of actualDocs) {

-  if (name.startsWith('all.')) continue;

-

-  assert.ok(

-    allMD.includes(name.replace(/\.\w+$/, '.md')),

-    `Unexpected output: out/doc/api/${name}, remove and rerun.`

-  );

-}

-

-const toc = fs.readFileSync(path.resolve(apiPath, 'index.html'), 'utf8');

-const re = /href="([^/]+\.html)"/;

-const globalRe = new RegExp(re, 'g');

-const links = toc.match(globalRe);

-assert.notStrictEqual(links, null);

-

-// Filter out duplicate links, leave just filenames, add expected JSON files.

-const linkedHtmls = [...new Set(links)].map((link) => link.match(re)[1]);

-const expectedJsons = linkedHtmls

-                       .map((name) => name.replace('.html', '.json'));

-const expectedDocs = linkedHtmls.concat(expectedJsons);

-

-// Test that all the relative links in the TOC match to the actual documents.

-for (const expectedDoc of expectedDocs) {

-  assert.ok(actualDocs.includes(expectedDoc), `${expectedDoc} does not exist`);

-}

-

-// Test that all the actual documents match to the relative links in the TOC

-// and that they are not empty files.

-for (const actualDoc of actualDocs) {

-  assert.ok(

-    expectedDocs.includes(actualDoc), `${actualDoc} does not match TOC`);

-

-  assert.ok(

-    fs.statSync(path.join(apiPath, actualDoc)).size !== 0,

-    `${actualDoc} is empty`

-  );

-}

diff --git a/test/known_issues/test-crypto-aes-wrap.js b/test/known_issues/test-crypto-aes-wrap.js

new file mode 100644

index 0000000..6fe3525

--- /dev/null

+++ b/test/known_issues/test-crypto-aes-wrap.js

@@ -0,0 +1,62 @@

+'use strict';

+const common = require('../common');

+if (!common.hasCrypto)

+  common.skip('missing crypto');

+

+const assert = require('assert');

+const crypto = require('crypto');

+

+const test = [

+  {

+    algorithm: 'aes128-wrap',

+    key: 'b26f309fbe57e9b3bb6ae5ef31d54450',

+    iv: '3fd838af4093d749',

+    text: '12345678123456781234567812345678'

+  },

+  {

+    algorithm: 'id-aes128-wrap-pad',

+    key: 'b26f309fbe57e9b3bb6ae5ef31d54450',

+    iv: '3fd838af',

+    text: '12345678123456781234567812345678123'

+  },

+  {

+    algorithm: 'aes192-wrap',

+    key: '40978085d68091f7dfca0d7dfc7a5ee76d2cc7f2f345a304',

+    iv: '3fd838af4093d749',

+    text: '12345678123456781234567812345678'

+  },

+  {

+    algorithm: 'id-aes192-wrap-pad',

+    key: '40978085d68091f7dfca0d7dfc7a5ee76d2cc7f2f345a304',

+    iv: '3fd838af',

+    text: '12345678123456781234567812345678123'

+  },

+  {

+    algorithm: 'aes256-wrap',

+    key: '29c9eab5ed5ad44134a1437fe2e673b4d88a5b7c72e68454fea08721392b7323',

+    iv: '3fd838af4093d749',

+    text: '12345678123456781234567812345678'

+  },

+  {

+    algorithm: 'id-aes256-wrap-pad',

+    key: '29c9eab5ed5ad44134a1437fe2e673b4d88a5b7c72e68454fea08721392b7323',

+    iv: '3fd838af',

+    text: '12345678123456781234567812345678123'

+  },

+];

+

+test.forEach((data) => {

+  const cipher = crypto.createCipheriv(

+    data.algorithm,

+    Buffer.from(data.key, 'hex'),

+    Buffer.from(data.iv, 'hex'));

+  const ciphertext = cipher.update(data.text, 'utf8');

+

+  const decipher = crypto.createDecipheriv(

+    data.algorithm,

+    Buffer.from(data.key, 'hex'),

+    Buffer.from(data.iv, 'hex'));

+  const msg = decipher.update(ciphertext, 'buffer', 'utf8');

+

+  assert.strictEqual(msg, data.text, `${data.algorithm} test case failed`);

+});

diff --git a/test/known_issues/test-crypto-des3-wrap.js b/test/known_issues/test-crypto-des3-wrap.js

new file mode 100644

index 0000000..75c8cd5

--- /dev/null

+++ b/test/known_issues/test-crypto-des3-wrap.js

@@ -0,0 +1,25 @@

+'use strict';

+const common = require('../common');

+if (!common.hasCrypto)

+  common.skip('missing crypto');

+

+const assert = require('assert');

+const crypto = require('crypto');

+

+// Test case for des-ede3 wrap/unwrap. des3-wrap needs extra 2x blocksize

+// then plaintext to store ciphertext.

+const test = {

+  key: Buffer.from('3c08e25be22352910671cfe4ba3652b1220a8a7769b490ba', 'hex'),

+  iv: Buffer.alloc(0),

+  plaintext: '32|RmVZZkFUVmpRRkp0TmJaUm56ZU9qcnJkaXNNWVNpTTU*|iXmckfRWZBG' +

+    'WWELweCBsThSsfUHLeRe0KCsK8ooHgxie0zOINpXxfZi/oNG7uq9JWFVCk70gfzQH8ZU' +

+    'JjAfaFg**'

+};

+

+const cipher = crypto.createCipheriv('des3-wrap', test.key, test.iv);

+const ciphertext = cipher.update(test.plaintext, 'utf8');

+

+const decipher = crypto.createDecipheriv('des3-wrap', test.key, test.iv);

+const msg = decipher.update(ciphertext, 'buffer', 'utf8');

+

+assert.strictEqual(msg, test.plaintext);

diff --git a/test/known_issues/test-crypto-hash-stream-pipe.js b/test/known_issues/test-crypto-hash-stream-pipe.js

new file mode 100644

index 0000000..d22281a

--- /dev/null

+++ b/test/known_issues/test-crypto-hash-stream-pipe.js

@@ -0,0 +1,46 @@

+// Copyright Joyent, Inc. and other Node contributors.

+//

+// Permission is hereby granted, free of charge, to any person obtaining a

+// copy of this software and associated documentation files (the

+// "Software"), to deal in the Software without restriction, including

+// without limitation the rights to use, copy, modify, merge, publish,

+// distribute, sublicense, and/or sell copies of the Software, and to permit

+// persons to whom the Software is furnished to do so, subject to the

+// following conditions:

+//

+// The above copyright notice and this permission notice shall be included

+// in all copies or substantial portions of the Software.

+//

+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN

+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,

+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR

+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE

+// USE OR OTHER DEALINGS IN THE SOFTWARE.

+

+'use strict';

+const common = require('../common');

+

+if (!common.hasCrypto)

+  common.skip('missing crypto');

+

+const assert = require('assert');

+const crypto = require('crypto');

+

+const stream = require('stream');

+const s = new stream.PassThrough();

+const h = crypto.createHash('sha3-512');

+const expect = '36a38a2a35e698974d4e5791a3f05b05' +

+               '198235381e864f91a0e8cd6a26b677ec' +

+               'dcde8e2b069bd7355fabd68abd6fc801' +

+               '19659f25e92f8efc961ee3a7c815c758';

+

+s.pipe(h).on('data', common.mustCall(function(c) {

+  assert.strictEqual(c, expect);

+  // Calling digest() after piping into a stream with SHA3 should not cause

+  // a segmentation fault, see https://github.com/nodejs/node/issues/28245.

+  assert.strictEqual(h.digest('hex'), expect);

+})).setEncoding('hex');

+

+s.end('aoeu');

diff --git a/test/known_issues/test-make-doc.js b/test/known_issues/test-make-doc.js

new file mode 100644

index 0000000..7f4f3ae

--- /dev/null

+++ b/test/known_issues/test-make-doc.js

@@ -0,0 +1,63 @@

+'use strict';

+const common = require('../common');

+if (common.isWindows) {

+  common.skip('`make doc` does not run on Windows');

+}

+

+// This tests that `make doc` generates the documentation properly.

+// Note that for this test to pass, `make doc` must be run first.

+

+const assert = require('assert');

+const fs = require('fs');

+const path = require('path');

+

+const apiPath = path.resolve(__dirname, '..', '..', 'out', 'doc', 'api');

+const mdPath = path.resolve(__dirname, '..', '..', 'doc', 'api');

+const allMD = fs.readdirSync(mdPath);

+const allDocs = fs.readdirSync(apiPath);

+assert.ok(allDocs.includes('index.html'));

+

+const actualDocs = allDocs.filter(

+  (name) => {

+    const extension = path.extname(name);

+    return extension === '.html' || extension === '.json';

+  }

+);

+

+for (const name of actualDocs) {

+  if (name.startsWith('all.')) continue;

+

+  assert.ok(

+    allMD.includes(name.replace(/\.\w+$/, '.md')),

+    `Unexpected output: out/doc/api/${name}, remove and rerun.`

+  );

+}

+

+const toc = fs.readFileSync(path.resolve(apiPath, 'index.html'), 'utf8');

+const re = /href="([^/]+\.html)"/;

+const globalRe = new RegExp(re, 'g');

+const links = toc.match(globalRe);

+assert.notStrictEqual(links, null);

+

+// Filter out duplicate links, leave just filenames, add expected JSON files.

+const linkedHtmls = [...new Set(links)].map((link) => link.match(re)[1]);

+const expectedJsons = linkedHtmls

+                       .map((name) => name.replace('.html', '.json'));

+const expectedDocs = linkedHtmls.concat(expectedJsons);

+

+// Test that all the relative links in the TOC match to the actual documents.

+for (const expectedDoc of expectedDocs) {

+  assert.ok(actualDocs.includes(expectedDoc), `${expectedDoc} does not exist`);

+}

+

+// Test that all the actual documents match to the relative links in the TOC

+// and that they are not empty files.

+for (const actualDoc of actualDocs) {

+  assert.ok(

+    expectedDocs.includes(actualDoc), `${actualDoc} does not match TOC`);

+

+  assert.ok(

+    fs.statSync(path.join(apiPath, actualDoc)).size !== 0,

+    `${actualDoc} is empty`

+  );

+}

diff --git a/test/known_issues/test-tls-cli-max-version-1.3.js b/test/known_issues/test-tls-cli-max-version-1.3.js

new file mode 100644

index 0000000..c04354f

--- /dev/null

+++ b/test/known_issues/test-tls-cli-max-version-1.3.js

@@ -0,0 +1,15 @@

+// Flags: --tls-max-v1.3

+'use strict';

+const common = require('../common');

+if (!common.hasCrypto) common.skip('missing crypto');

+

+// Check that node `--tls-max-v1.3` is supported.

+

+const assert = require('assert');

+const tls = require('tls');

+

+assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');

+assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.2');

+

+// Check the min-max version protocol versions against these CLI settings.

+require('./test-tls-min-max-version.js');

diff --git a/test/known_issues/test-tls-cli-min-max-conflict.js b/test/known_issues/test-tls-cli-min-max-conflict.js

new file mode 100644

index 0000000..68aae4c

--- /dev/null

+++ b/test/known_issues/test-tls-cli-min-max-conflict.js

@@ -0,0 +1,14 @@

+'use strict';

+const common = require('../common');

+if (!common.hasCrypto) common.skip('missing crypto');

+

+// Check that conflicting TLS protocol versions are not allowed

+

+const assert = require('assert');

+const child_process = require('child_process');

+

+const args = ['--tls-min-v1.3', '--tls-max-v1.2', '-p', 'process.version'];

+child_process.execFile(process.argv[0], args, (err) => {

+  assert(err);

+  assert(/not both/.test(err.message));

+});

diff --git a/test/known_issues/test-tls-cli-min-version-1.3.js b/test/known_issues/test-tls-cli-min-version-1.3.js

new file mode 100644

index 0000000..1bccc2f

--- /dev/null

+++ b/test/known_issues/test-tls-cli-min-version-1.3.js

@@ -0,0 +1,15 @@

+// Flags: --tls-min-v1.3

+'use strict';

+const common = require('../common');

+if (!common.hasCrypto) common.skip('missing crypto');

+

+// Check that node `--tls-min-v1.3` is supported.

+

+const assert = require('assert');

+const tls = require('tls');

+

+assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');

+assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.3');

+

+// Check the min-max version protocol versions against these CLI settings.

+require('./test-tls-min-max-version.js');

diff --git a/test/known_issues/test-tls-client-renegotiation-13.js b/test/known_issues/test-tls-client-renegotiation-13.js

new file mode 100644

index 0000000..075eb70

--- /dev/null

+++ b/test/known_issues/test-tls-client-renegotiation-13.js

@@ -0,0 +1,41 @@

+'use strict';

+

+const common = require('../common');

+const fixtures = require('../common/fixtures');

+

+// Confirm that for TLSv1.3, renegotiate() is disallowed.

+

+const {

+  assert, connect, keys

+} = require(fixtures.path('tls-connect'));

+

+const server = keys.agent10;

+

+connect({

+  client: {

+    ca: server.ca,

+    checkServerIdentity: common.mustCall(),

+  },

+  server: {

+    key: server.key,

+    cert: server.cert,

+  },

+}, function(err, pair, cleanup) {

+  assert.ifError(err);

+

+  const client = pair.client.conn;

+

+  assert.strictEqual(client.getProtocol(), 'TLSv1.3');

+

+  const ok = client.renegotiate({}, common.mustCall((err) => {

+    assert.throws(() => { throw err; }, {

+      message: 'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',

+      code: 'ERR_SSL_WRONG_SSL_VERSION',

+      library: 'SSL routines',

+      reason: 'wrong ssl version',

+    });

+    cleanup();

+  }));

+

+  assert.strictEqual(ok, false);

+});

diff --git a/test/known_issues/test-tls-keylog-tlsv13.js b/test/known_issues/test-tls-keylog-tlsv13.js

new file mode 100644

index 0000000..0f65564

--- /dev/null

+++ b/test/known_issues/test-tls-keylog-tlsv13.js

@@ -0,0 +1,32 @@

+'use strict';

+

+const common = require('../common');

+if (!common.hasCrypto)

+  common.skip('missing crypto');

+

+const assert = require('assert');

+const tls = require('tls');

+const fixtures = require('../common/fixtures');

+

+const server = tls.createServer({

+  key: fixtures.readKey('agent2-key.pem'),

+  cert: fixtures.readKey('agent2-cert.pem'),

+  // Amount of keylog events depends on negotiated protocol

+  // version, so force a specific one:

+  minVersion: 'TLSv1.3',

+  maxVersion: 'TLSv1.3',

+}).listen(() => {

+  const client = tls.connect({

+    port: server.address().port,

+    rejectUnauthorized: false,

+  });

+

+  const verifyBuffer = (line) => assert(Buffer.isBuffer(line));

+  server.on('keylog', common.mustCall(verifyBuffer, 5));

+  client.on('keylog', common.mustCall(verifyBuffer, 5));

+

+  client.once('secureConnect', () => {

+    server.close();

+    client.end();

+  });

+});

diff --git a/test/known_issues/test-tls-no-sslv3.js b/test/known_issues/test-tls-no-sslv3.js

new file mode 100644

index 0000000..1acb1f9

--- /dev/null

+++ b/test/known_issues/test-tls-no-sslv3.js

@@ -0,0 +1,49 @@

+'use strict';

+const common = require('../common');

+if (!common.hasCrypto)

+  common.skip('missing crypto');

+

+if (common.opensslCli === false)

+  common.skip('node compiled without OpenSSL CLI.');

+

+const assert = require('assert');

+const tls = require('tls');

+const spawn = require('child_process').spawn;

+const fixtures = require('../common/fixtures');

+

+const cert = fixtures.readKey('rsa_cert.crt');

+const key = fixtures.readKey('rsa_private.pem');

+const server = tls.createServer({ cert, key }, common.mustNotCall());

+const errors = [];

+let stderr = '';

+

+server.listen(0, '127.0.0.1', function() {

+  const address = `${this.address().address}:${this.address().port}`;

+  const args = ['s_client',

+                '-ssl3',

+                '-connect', address];

+

+  const client = spawn(common.opensslCli, args, { stdio: 'pipe' });

+  client.stdout.pipe(process.stdout);

+  client.stderr.pipe(process.stderr);

+  client.stderr.setEncoding('utf8');

+  client.stderr.on('data', (data) => stderr += data);

+

+  client.once('exit', common.mustCall(function(exitCode) {

+    assert.strictEqual(exitCode, 1);

+    server.close();

+  }));

+});

+

+server.on('tlsClientError', (err) => errors.push(err));

+

+process.on('exit', function() {

+  if (/unknown option -ssl3/.test(stderr)) {

+    common.printSkipMessage('`openssl s_client -ssl3` not supported.');

+  } else {

+    assert.strictEqual(errors.length, 1);

+    // OpenSSL 1.0.x and 1.1.x report invalid client versions differently.

+    assert(/:wrong version number/.test(errors[0].message) ||

+           /:version too low/.test(errors[0].message));

+  }

+});

diff --git a/test/known_issues/test-tls-ticket-12.js b/test/known_issues/test-tls-ticket-12.js

new file mode 100644

index 0000000..600c571

--- /dev/null

+++ b/test/known_issues/test-tls-ticket-12.js

@@ -0,0 +1,12 @@

+'use strict';

+const common = require('../common');

+if (!common.hasCrypto)

+  common.skip('missing crypto');

+

+// Run test-tls-ticket.js with TLS1.2

+

+const tls = require('tls');

+

+tls.DEFAULT_MAX_VERSION = 'TLSv1.2';

+

+require('./test-tls-ticket.js');

diff --git a/test/known_issues/test-tls-ticket-cluster.js b/test/known_issues/test-tls-ticket-cluster.js

new file mode 100644

index 0000000..cc4f46e

--- /dev/null

+++ b/test/known_issues/test-tls-ticket-cluster.js

@@ -0,0 +1,135 @@

+// Copyright Joyent, Inc. and other Node contributors.

+//

+// Permission is hereby granted, free of charge, to any person obtaining a

+// copy of this software and associated documentation files (the

+// "Software"), to deal in the Software without restriction, including

+// without limitation the rights to use, copy, modify, merge, publish,

+// distribute, sublicense, and/or sell copies of the Software, and to permit

+// persons to whom the Software is furnished to do so, subject to the

+// following conditions:

+//

+// The above copyright notice and this permission notice shall be included

+// in all copies or substantial portions of the Software.

+//

+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN

+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,

+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR

+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE

+// USE OR OTHER DEALINGS IN THE SOFTWARE.

+

+'use strict';

+const common = require('../common');

+if (!common.hasCrypto)

+  common.skip('missing crypto');

+

+const assert = require('assert');

+const tls = require('tls');

+const cluster = require('cluster');

+const fixtures = require('../common/fixtures');

+

+const workerCount = 4;

+const expectedReqCount = 16;

+

+if (cluster.isMaster) {

+  let reusedCount = 0;

+  let reqCount = 0;

+  let lastSession = null;

+  let shootOnce = false;

+  let workerPort = null;

+

+  function shoot() {

+    console.error('[master] connecting', workerPort, 'session?', !!lastSession);

+    const c = tls.connect(workerPort, {

+      session: lastSession,

+      rejectUnauthorized: false

+    }, () => {

+      c.end();

+    }).on('close', () => {

+      // Wait for close to shoot off another connection. We don't want to shoot

+      // until a new session is allocated, if one will be. The new session is

+      // not guaranteed on secureConnect (it depends on TLS1.2 vs TLS1.3), but

+      // it is guaranteed to happen before the connection is closed.

+      if (++reqCount === expectedReqCount) {

+        Object.keys(cluster.workers).forEach(function(id) {

+          cluster.workers[id].send('die');

+        });

+      } else {

+        shoot();

+      }

+    }).once('session', (session) => {

+      assert(!lastSession);

+      lastSession = session;

+    });

+

+    c.resume(); // See close_notify comment in server

+  }

+

+  function fork() {

+    const worker = cluster.fork();

+    worker.on('message', ({ msg, port }) => {

+      console.error('[master] got %j', msg);

+      if (msg === 'reused') {

+        ++reusedCount;

+      } else if (msg === 'listening' && !shootOnce) {

+        workerPort = port || workerPort;

+        shootOnce = true;

+        shoot();

+      }

+    });

+

+    worker.on('exit', () => {

+      console.error('[master] worker died');

+    });

+  }

+  for (let i = 0; i < workerCount; i++) {

+    fork();

+  }

+

+  process.on('exit', () => {

+    assert.strictEqual(reqCount, expectedReqCount);

+    assert.strictEqual(reusedCount + 1, reqCount);

+  });

+  return;