mirror of
https://github.com/nodejs/node.git
synced 2026-11-09 15:11:11 -05:00
Brian MuenzenmeyerandFilip Skokan
6fc8826ea4
Return the private key, end-entity certificate, and any other non-matching certificates from a PKCS#12 (.p12/.pfx) bundle as a KeyObject and X509Certificate instances. Node.js already parses PKCS#12 in SecureContext::LoadPKCS12, which backs tls's `pfx` option, but the results are consumed directly into an SSL_CTX and never reach JavaScript. Callers who need the key or the certificates for anything other than an immediate TLS connection have to shell out to `openssl pkcs12` or take a userland dependency. SecureContext::LoadPKCS12 now uses this same parsing logic. The binding wraps d2i_PKCS12_bio() and PKCS12_parse() and follows their semantics, matching the existing TLS path: the first private key is returned, the end-entity certificate is the one associated with that key, and any remaining certificates are returned through `additionalCertificates`. A bundle containing no private key reports `certificate` as null and returns its certificates through `additionalCertificates`. Absent and empty passphrases are kept distinct, since OpenSSL treats them differently. Bundles that require OpenSSL's legacy provider throw ERR_CRYPTO_UNSUPPORTED_OPERATION, reusing the error added for the TLS path. Signed-off-by: bmuenzenmeyer <brian.muenzenmeyer@gmail.com> Co-authored-by: Filip Skokan <panva.ip@gmail.com> PR-URL: https://github.com/nodejs/node/pull/65627 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
126 lines
5.2 KiB
C++
126 lines
5.2 KiB
C++
// Copyright Joyent, Inc. and other Node contributors.
|
|
//
|
|
// Permission is hereby granted, free of charge, to any person obtaining a
|
|
// copy of this software and associated documentation files (the
|
|
// "Software"), to deal in the Software without restriction, including
|
|
// without limitation the rights to use, copy, modify, merge, publish,
|
|
// distribute, sublicense, and/or sell copies of the Software, and to permit
|
|
// persons to whom the Software is furnished to do so, subject to the
|
|
// following conditions:
|
|
//
|
|
// The above copyright notice and this permission notice shall be included
|
|
// in all copies or substantial portions of the Software.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
|
|
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
|
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
|
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
|
|
// USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
|
|
#include "node_crypto.h"
|
|
#include "async_wrap-inl.h"
|
|
#include "debug_utils-inl.h"
|
|
#include "memory_tracker-inl.h"
|
|
#include "node_external_reference.h"
|
|
#include "threadpoolwork-inl.h"
|
|
#include "v8.h"
|
|
|
|
namespace node {
|
|
|
|
using v8::Context;
|
|
using v8::Local;
|
|
using v8::Object;
|
|
using v8::Value;
|
|
|
|
namespace crypto {
|
|
|
|
#define CRYPTO_NAMESPACE_LIST_BASE(V) \
|
|
V(AES) \
|
|
V(ChaCha20Poly1305) \
|
|
V(CipherBase) \
|
|
V(DiffieHellman) \
|
|
V(DSAAlg) \
|
|
V(ECDH) \
|
|
V(Hash) \
|
|
V(HKDFJob) \
|
|
V(Hmac) \
|
|
V(Keygen) \
|
|
V(Keys) \
|
|
V(Mac) \
|
|
V(NativeCryptoKey) \
|
|
V(NativeKeyObject) \
|
|
V(PBKDF2Job) \
|
|
V(PKCS12Parser) \
|
|
V(Random) \
|
|
V(RSAAlg) \
|
|
V(SecureContext) \
|
|
V(Sign) \
|
|
V(SPKAC) \
|
|
V(Timing) \
|
|
V(Util) \
|
|
V(Verify) \
|
|
V(X509Certificate)
|
|
|
|
#if OPENSSL_WITH_ARGON2
|
|
#define ARGON2_NAMESPACE_LIST(V) V(Argon2)
|
|
#else
|
|
#define ARGON2_NAMESPACE_LIST(V)
|
|
#endif // OPENSSL_WITH_ARGON2
|
|
|
|
#if OPENSSL_WITH_KEM
|
|
#define KEM_NAMESPACE_LIST(V) V(KEM)
|
|
#else
|
|
#define KEM_NAMESPACE_LIST(V)
|
|
#endif
|
|
|
|
#if OPENSSL_WITH_EVP_MAC
|
|
#define KMAC_NAMESPACE_LIST(V) V(Kmac)
|
|
#else
|
|
#define KMAC_NAMESPACE_LIST(V)
|
|
#endif // OPENSSL_WITH_EVP_MAC
|
|
|
|
#define TURBOSHAKE_NAMESPACE_LIST(V) V(TurboShake)
|
|
|
|
#ifdef OPENSSL_NO_SCRYPT
|
|
#define SCRYPT_NAMESPACE_LIST(V)
|
|
#else
|
|
#define SCRYPT_NAMESPACE_LIST(V) V(ScryptJob)
|
|
#endif // OPENSSL_NO_SCRYPT
|
|
|
|
#define CRYPTO_NAMESPACE_LIST(V) \
|
|
CRYPTO_NAMESPACE_LIST_BASE(V) \
|
|
ARGON2_NAMESPACE_LIST(V) \
|
|
KEM_NAMESPACE_LIST(V) \
|
|
KMAC_NAMESPACE_LIST(V) \
|
|
SCRYPT_NAMESPACE_LIST(V) \
|
|
TURBOSHAKE_NAMESPACE_LIST(V)
|
|
|
|
void Initialize(Local<Object> target,
|
|
Local<Value> unused,
|
|
Local<Context> context,
|
|
void* priv) {
|
|
Environment* env = Environment::GetCurrent(context);
|
|
|
|
if (!InitCryptoOnce(env->isolate())) {
|
|
return;
|
|
}
|
|
|
|
#define V(Namespace) Namespace::Initialize(env, target);
|
|
CRYPTO_NAMESPACE_LIST(V)
|
|
#undef V
|
|
}
|
|
|
|
void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
|
|
#define V(Namespace) Namespace::RegisterExternalReferences(registry);
|
|
CRYPTO_NAMESPACE_LIST(V)
|
|
#undef V
|
|
}
|
|
} // namespace crypto
|
|
} // namespace node
|
|
|
|
NODE_BINDING_CONTEXT_AWARE_INTERNAL(crypto, node::crypto::Initialize)
|
|
NODE_BINDING_EXTERNAL_REFERENCE(crypto,
|
|
node::crypto::RegisterExternalReferences)
|