tls: make server not use DHE in less than 1024bits

DHE key lengths less than 1024bits is already weaken as pointed out in
https://weakdh.org/ . 1024bits will not be safe in near future. We
will extend this up to 2048bits somedays later.

Author: Shigeki Ohtsu

doc/api/tls.markdown

@@ -183,8 +183,10 @@ automatically set as a listener for the [secureConnection][] event.  The
 
   - `dhparam`: A string or `Buffer` containing Diffie Hellman parameters,
     required for Perfect Forward Secrecy. Use `openssl dhparam` to create it.
-    If omitted or invalid, it is silently discarded and DHE ciphers won't be
-    available.
+    Its key length should be greater than or equal to 1024bits, otherwise
+    it throws an error. It is recommended to use 2048bits or more for
+    enough strong security. If omitted or invalid, it is silently
+    discarded and DHE ciphers won't be available.
 
   - `handshakeTimeout`: Abort the connection if the SSL/TLS handshake does not
     finish in this many milliseconds. The default is 120 seconds.

src/node_crypto.cc

@@ -757,6 +757,10 @@ void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {
   if (dh == nullptr)
     return;
 
+  if (BN_num_bits(dh->p) < 1024) {
+    return env->ThrowError("DH parameter is less than 1024bits");
+  }
+
   SSL_CTX_set_options(sc->ctx_, SSL_OP_SINGLE_DH_USE);
   int r = SSL_CTX_set_tmp_dh(sc->ctx_, dh);
   DH_free(dh);

test/parallel/test-tls-dhe.js

@@ -62,8 +62,11 @@ function test(keylen, expectedCipher, cb) {
 }
 
 function test512() {
-  test(512, 'DHE-RSA-AES128-SHA256', test1024);
-  ntests++;
+  assert.throws(function() {
+    test(512, 'DHE-RSA-AES128-SHA256', test1024);
+  },
+    /DH parameter is less than 1024bits/
+  );
 }
 
 function test1024() {